@Tarah I have not been successfully phished, however, we do run these training campaigns and I have responded to several users who have clicked on phishing emails. They always feel like shit. It's basic psychology. You're not going to punish someone worse than they can punish themselves. Instead, providing positive reinforcement to your users and giving them incentive to increase their vigilance and suspicion works.

One user I will use as an example, had multiple incidents in one year. We had to change their passwords, expire sessions, lock them down, whole deal, multiple times. We positively reinforced, provided training, and they are now one of our top reporters of suspicious emails. No incidents in 2024 from this user.