Heh, my office does this with phishing. At irregular intervals—but a few times a month—they send us fake phishing emails and congratulate us if we catch them, or chastise and educate if we click the links.