It's silly to do it inhouse. It creates distrust. That is why you pay consultants. They send out the phishing test, and hopefully regular people bond with the

It's silly to do it inhouse. It creates distrust. That is why you pay consultants. They send out the phishing test, and hopefully regular people bond with the security people in an effort to pass it. I mean, after all, security and regular people in the company should want the same thing (company success... which implies not giving away things to phishing probes)