The implication of all this hubbub is that phishing is effective on the two ends of the spectrum: either very poorly written that you mass email hoping to find someone who's not very tech literate, or the highly targeted that's plausible almost exclusively if you have some insider information Fwiw if you're a major corporation that really wants to harden their systems, the correct way to go about a test is to use the second strategy - because all of us have sat through trainings where phishing was insanely obvious. These didn't actually teach you anything You def run the risk of pissing off staff, but that's probably worth it for the right type of corporate