This has nothing useful to your answer but... chuckling reading this from my yesterday. We started to use PhishMe about a year and a half ago. At that time we got an e-mail saying they were running a round of them and how to respond if a customer asked what it was. Then it happened again next quarter, and we got the same notice. Then, a year went by without them.. Meanwhile, our overall IT departments across major companies are merging, and more than 1/2 of IT has had turnover from early buyouts and then from several rounds of layoffs. So, the woman whose name is attached to this as the account contact in all documentation is no longer w/ the company. Yesterday our customers start getting these... the newly merged divisions in NY start getting them, too, and their IT doesn't know what they are. They don't seem to know we had previously used them even, because they were part of the sister company they've now merged everyone from. So, on their end they kick off the emergency plan to block the IP of the sender/etc., which is PhishMe, successfully do all that, but don't bother to actually send out any communication to the "new" team only to their old. Meanwhile I get notification that many got this e-mail message, so start doing research to see if it was really coming from them. Checked the headers, sending smtp server, called the host's support that owned the IP the e-mail embedded items were hosted by (Blue Box Cloud) and talked to their support to confirm it was owned by PhishMe (it was), matched their MX records back to PhishMe, etc... I conclude it's legitatmely from PhishMe and send everyone in the new group a reminder of the process to respond w/ customers, they respond saying no they've validated it's a spoof. I respond back w/ everything I know, they finally belived it enough and then I was able to get them the contact internally in charge now, blah blah blah, they unblock. Corporate bureaucracy at its finest.

Anecdotally about the service, one thing we're told about it is if a customer is concerned they will be reported to management for clicking on the test, we're told they do not do this and they're supposed to tell the customer not to worry and thanks, basically... To which I wonder if we aren't doing any reporting based off of it, what the point is, and why couldn't we just do this internally on our own?