The weakest link. Phishing emails as a pentesting tool