The part about sharing among other employees when an internal phishing test is active is intriguing to me. In my organization, when someone gets a phishing lure - they tell everyone around them to watch out for it. I wonder how this impacts success rates.