I'm going by studies such as these: https://www.computer.org/cms/Computer.org/ComputingNow/pdfs/IEEESecurityPrivacy-SpearPhishing-Jan-Feb2014.pdf https://www.co

I'm going by studies such as these: https://www.computer.org/cms/Computer.org/ComputingNow/pdfs/IEEESecurityPrivacy-SpearPhishing-Jan-Feb2014.pdf https://www.computer.org/cms/Computer.org/ComputingNow/pdfs/... I suppose it depends on how we measure effectiveness. What was the false positive rate you observed in addition to the marked increase in reports of real phishing attempts? It would be interesting to see what impact the "blame and train" internal phishing has on overall company productivity compared to just not doing it.