Don't phish your employees because it does more harm than good:
https://www.seancassidy.me/phishing-simulations-considered-harmful.html

Why? A thread:

Phishing simulations are often not realistic because they rely on bypassing anti-phishing controls via allowlists or use insider information.

Phishing simulations put the onus on the employee not to be tricked, rather than on harm reduction like SSO+WebAuthn. Employees don't like being tricked and are busy trying to do their job.

We already know that phishing is effective! Showing it again at your company isn't useful to you or to anyone else. And giving employees phishing training over and over is not a reliable enough way to reduce risk.

What should you do instead?
1. General security awareness training
2. Make phishing emails easy to report
3. Harm reduction if employees do fall for phishes
4. Defang phishes for measurement
5. Avoid shaming victims