1. Have you run any phishing simulation in the last 12 months?

Yes No / Not sure

Baseline measurement required.

2. Do repeat-clickers get targeted follow-up training?

Yes No / Not sure

Data-driven training outperforms mass-mailed lessons.

3. Are results shared anonymously with execs?

Yes No / Not sure

Keeps accountability without public shaming.

4. Does training include the BEC / wire-fraud scenario?

Yes No / Not sure

The highest-loss scenario in practice.

5. Do you test with QR-code phishing scenarios?

Yes No / Not sure

Quishing is now mainstream.

6. Is there clear reporting workflow for suspected phish?

Yes No / Not sure

Users need a simple "report" button.

7. Are test emails realistic (logos, tone, urgency)?

Yes No / Not sure

Easy fakes train for easy phish only.

8. Does training cover credential-harvesting + credential-stuffing risk?

Yes No / Not sure

Teaches the follow-on attack.

9. Are exec-team members included in sim tests?

Yes No / Not sure

Whale-phishing targets them first.

10. Is there a post-incident lesson-learned session?

Yes No / Not sure

Turn near-misses into training.

Employee Phishing Trainer