[DoofusOfDeath]

I'm not sure I follow your logic.

IIUC, a traditional phishing test involves:

(a) Prior training for what employees are supposed to look for, and how to respond if they think they're being phished.

(b) Unannounced drills to confirm that employees act in accordance to (a).

If some GoDaddy employees did not act in accordance to the training, how is that anything but a failed test?

[EDIT] I just realized that "how is that anything but a failed test" could sound reductive. FWIW, I would call this a test failure and also a really unwise test design.

[jldugger]

Honestly, blaming the employee here is the fallacy. Employees don't fail phishing tests, companies do.