Depending on the size and culture of the company I feel like that's a pretty risky proposition unless you've got senior leadership really chomping at the bit ri

Depending on the size and culture of the company I feel like that's a pretty risky proposition unless you've got senior leadership really chomping at the bit right after a major incident. It's quite likely someone pretty high up in the company will fall for the fake phishing and then you've got a bunch of politics in your lap.