If you look at the logs of phishing exercises you can often see employees messing with the red team, like entering invalid creds for CISO or CEO and stuff. I t

If you look at the logs of phishing exercises you can often see employees messing with the red team, like entering invalid creds for CISO or CEO and stuff. I think phishing exercises should provide much more details, e.g. the following metrics: (1) # targets opened email (2) # clicked link (3) # who entered valid username (must match some identifier in email - to prevent trolling) (3) # who entered password (4) # entered valid(!) password (5) # entered MFA/code or did Push (6) # auth cookies stolen (full compromise) Otherwise it's difficult to compare any of these tests and understand the actual risks and success rates.