Our company phishes its own employees, through a contract with an external security consultant. Hilariously, those emails include a special header that gives a

Our company phishes its own employees, through a contract with an external security consultant. Hilariously, those emails include a special header that gives away their source. An engineering co-worker wrote a script that send them directly to the trash, even though we are supposed to send them to the consultant to "report the incident". Since there's zero reward/incentive from reporting them, most of the engineers don't bother with them anymore. For the non-engineers, I imagine it's better for them to click on a test email and learn their lesson rather than clicking on a link from an actual phisher. We've had phishing attacks work in the past, so I suppose it's not a bad practice overall for non-technical employees.