alpinist79

None. And you don’t even need the simulation. Assume people are going to click on whatever link anyway and architect your security around that. Yes, it would be nice if people didn’t make stupid mistakes, but unfortunately they do. Also if the phishing tests are mandatory for your industry, I am sorry.

Security expert here, I see a lot of different environments. A lot of organisations still manage infrastructure in a very traditional way. For a lot of engineers, iac is just not something they do.

I’ve worked at very small and very large ( 100K+ headcount ) organisations and unless there is an absolute crisis, it’s pretty slow going. Things move slowly. That’s par for the course unless there’s a real calamity.