I would imagine we're disagreeing with the "at what cost"? As in, is the cost of: 1. Losing the trust of your coworkers 2. Causing public reputation damage 3.

I would imagine we're disagreeing with the "at what cost"? As in, is the cost of: 1. Losing the trust of your coworkers 2. Causing public reputation damage 3. Potentially harming coworkers emotionally worth the gain of having a slightly more effective phishing training? I would argue no. I would also say that it isn't nearly as important as implementing other measures - U2F being a big one that I'd mentioned, but there are plenty of others. It's certainly not where I'd recommend anyone start.