You answer:

We are a non-profit organization, and therefore we are interested in the question of whether companies like ours need protection from phishing if they do not have their own brand or product. I think that organizations such as our pharmacology should not be of interest to scammers, because there seems to be nothing to steal from us. But here they write that even user accounts may be at risk, so the question arose how easier it is to protect this data, is such protection necessary at all, or are the fears in vain and we can safely work without it?