@nprofile1q... a large company i worked at had mandatory phishing training as a video. they outsourced but HR forgot to let anyone know that the email for the video would come from an external firm and the link would also be a seemingly random outside link.
engineering mostly reported the email as a phishing attack. the VP of eng was proud, HR was pissed and embarassed.
some of us argued that we should be given a passing grade and not have to watch the video but, sadly, they still made us waste our time watching it.