AWS does IR, credit card canarytokens, shared responsibility, phishing tests do harm - ESW #387