I sent a note to the security incident report address for the bank, telling them they're training their users to click on phishing emails. They sent back some noncommittal answer.
Once in a while you'll see a follow up email from the sender saying that they are aware of many people reporting the email as a phishing attempt and that reporting the email was wrong and that link to that particular website is a company approved tool and that employees are required to complete the survey at the link for some department or center's benefit.
This wouldn't be a problem if we had internal websites with standard tools like a survey builder and such, but getting our IT contractor in my org to do the basic functions of their jobs takes a herculean effort, getting them to support a basic internal tool would be a multi-year campaign. I can appreciate how much easier (and cheaper) it can be to use external tools and train users to disobey IT and security recommendations about phishing.
The problem with bureaucracies and hackers is that both will take the path of least resistance, and the hard problem of IT security in large orgs is how to separate the two into distinct categories.
That's exactly what a spearphisher would say. Still not clicking a link. Of course, I would rarely read the company email anyway.
I've seen some wonky stuff being put out by them and they are oblivious. As their work often crosses the line into actual web-dev stuff that has security implications. ie, landing pages and emails. And not 2FAing the countless marketing tools they use nor letting the more experienced devs know what they are up to.