[clavalle]

True. This thread has me thinking about how a controlled social engineering hacking event might play out just for the sake of education and awareness. (especially since one of my clients got hit badly with a phishing attack recently...less than a single percentage 'success' rate by the attacker but still cost them almost $100K).

Tough problem.

[jerf]

There are commercially-available off-the-shelf phishing training services, such as https://www.knowbe4.com/phishing-security-test-offer .

Disclaimer: My employer has used this, but I was uninvolved with the choice and have no stake in knowbe4. Just using it as an example I have to hand. I believe there are quite a few choices.