@beardedtechguy you need both. Folks need to understand what to do when an incident occurs and also needs to know what the signs are (e.g. phishing). A good way to weaken trust in your organization is to set folks up for failure. Why not give them the knowledge and tools to be successful? Unannounced only weed out the employees who need help and creates hostility and paranoia. Management has a key role here to keep the accountability on point.

@beardedtechguy probably implied and goes without saying also but I'll say it anyway. Unannounced drills should still reasonably consider environmental and workload factors by those planning it even when those involved as responders are unaware. You wouldn't spontaneously decide to have a fire drill if the build was actually on fire at the same time. That's just mean 🤷