I once got dinged for not reporting. I saw an email that was clearly an internal security campaign. I deleted it. I received an email a day or two later stating that I failed to take action on a phishing attempt. Damned if you do; damned if you don't.

For a while I had a thunderbird filter to automate forwarding based on our provider's email header.

They disabled SMTP and the Gmail web client has no such ability to filter on arbitrary email headers.

You can setup a Google app automation to do this for you.

I did for e.g. knowbe4 since all their test emails have the same header information. It made it quite easy to never see any of their attempts, though I did have to check every once in a while to see if I'd been signed up for any random learning and it removed those emails as well..

iirc, the same company had locked down the allowed oauth apps, so you would have needed an exception from security to run one.

I doubt they'd have granted an exception to stop getting annoyed by their own training.