I’ve never ever run a phishing campaign against a medium+ sized organization and had zero hits. It’s great that you think you could never be conned, but I’d be interested if you think that scales to your entire security team.

A well-timed, creative phishing campaign can include things like a “regarding your employment status” right after the company announces layoffs, if you’re talking malicious actor and not watered-down security awareness exercise