A company's employees have started receiving convincing emails that appear to come from the IT department, asking them to click a link and re-enter their network credentials on a lookalike login page. Several users have already submitted their passwords. Which mitigation technique most directly addresses the root cause of this type of attack?