A friend works for a company that fires employees after failing three phishing tests.
It doesn’t solve the problem for those people, but it does work for that company. What has priority depends on your management style :)
The only way this kind of policy makes sense is if you have to actually give the phishing site some kind of credential in order to fail, vs. merely opening on it.
If someone has a Chrome zero-day, we're done anyway. Just post it on HN.
The much more relevant battle is preventing credential theft, which you can solve completely at the technical level with U2F. And if you can't, user education on "check the URL before typing your password" is a little more realistic than "don't open links from email ever."
As a security engineer in a previous life, I always open the links in phishing emails (in an isolated and secure VM). I would fail the tests at work every time, but luckily the person in charge of them knew what I was doing and didn't care.
It's still worth trying though!
In fact, the worst offenders were actually rewarded. They were the only ones who had two factor auth for their eBay accounts. Back then we didn't have soft tokens -- the only way to do 2 factor was to get a physical RSA token, which cost about $10 at the time. So only the "best" customers were worth the cost.
DMZ networks are hard to get right and hard to admin, and almost always end up getting some sort of exception for certain business needs.
Asking a user to admin that, or having no admin at all, feels almost impossible.
I was working on anti-phishing in 2003, before it had the name phishing. We were trying to teach our users not to fall for the scams.
It didn't work. People will fall for the same scam over and over.
The conclusion we came to was that the only solution to phishing was education, and education was also nearly impossible to get 100% coverage.
I wish you luck, but don't get discouraged if it doesn't work. We've been trying to educate people about phishing for 17+ years. :)
We shifted our focus to tracking the phishing sites and then tying that back to which user accounts were hacked, and disabling the hacked accounts and notifying the users before damage could be done.
PayPal actually holds the patent on what we built, along with a ton of other anti-phishing and phishing site tracking patents.