I think that's an understated point. We certainly haven't stopped phishing from being successful - but we have heavily increased the rate at which malicious emails get reported. Most of these bad emails do get sent to a lot of people after all.

That makes it actionable - if something looks nasty I can detect every recipient and have it deleted from their inbox. I can report block malicious URLs on the firewall and report them to Google Safebrowse, and so on.