What is the standard measures taken to protect against spear phishing? Mostly educating users and trying to filter out the mails?

Palantir basically started the red team in a position where they had successfully spear phished someone and that seems to be common practice. Is trying to protect against it just a waste of time and should the resources be invested into proper segmentation to protect against the successful spear phis case? Or are people usually 80/20ing this and taking anti spear phish measures but only to an extend that covers a lot of ground at relatively low cost/time?