Yeah - I’d be wary of doing it without changing the parameters for that reason. But obviously you can’t check a link without checking a link.

It would also be interesting to hear whether someone actually considers me to have failed anything when visiting a (faux) attacker’s link on my own device off the company network and entering no credentials.

They’re probably not that advanced with it. If anything, you’ll upset IT with extra paperwork to grant you the exemption from the hit.

I wonder what happens when a bot crawls one of the phishing sites and triggers all the unique links...

Next time I’ll try that. Hit all the Id’s but my own and take the day off when everyone else is sent to reeducation camp.