For those who care to know and read, Ran a phishing simulation for a client last month. Simple email. Nothing fancy. ‘Your account will be suspended in 24 hours. Click here to verify.’ 40% of staff clicked it. When I sat down with the team after, one person said something that stuck with me: He said, ‘It looked exactly like the real ones we get every week.’ That's the actual problem. Not that people are careless. It's that attackers have gotten good at looking legitimate, and most security awareness training still teaches people to spot the obvious fakes. We redesigned the training around that. Fewer ‘spot the bad grammar’ exercises. Now more of, ‘here's what a genuinely convincing attempt looks like, and here's the one thing that still gives it away.’ Second simulation, done four weeks later: 12%. That's the number that matters. Not whether people fell for it once. Whether the training actually changed behavior. Phishing simulations shouldn’t be boring because attackers ain’t, trust me