@dnsprincess Worth it and it works if the results are socialized and the employees know how their actions directly result in the overall security/vulnerability of the company.

I work in the hospitality vertical. We managed, through deliberate and repeated trainings and through socialization of the message, to reduce our click rate on email tests from approximately 30% which is pretty average across the industry, to 1% globally.

Appropriately administered and with the right type of buy-in, phish testing programs work.