This happens at my work but if you click on a link you need to do a phishing awareness training module. I think this is an effective approach because it doesn't

This happens at my work but if you click on a link you need to do a phishing awareness training module. I think this is an effective approach because it doesn't seek to punish anyone but instead train them to be more aware.