This, so much this! We have been on a year long plan sending test scam emails to our staff. We still have 5% who will click on anything. Sometimes I think they do it intentionally so that they can avoid work by being required to take email security training. I'm lobbying management to start writing up chronic offenders.