I recently got reported for clicking a phishing link three times. Looking at the audit log all three of these clicks supposedly happened within seconds of each

I recently got reported for clicking a phishing link three times. Looking at the audit log all three of these clicks supposedly happened within seconds of each other. My suspicion is the training company realized no one was falling for the obvious bait anymore and they needed to gin up the numbers to keep the company convinced that paying for their services was worthwhile. Meanwhile all corporate teams use the same VLAN and DHCP Address Pool. There is zero separation of departments on the network. A lot of companies get this precise situation backwards as we have.