The first statement here is that researchers say the phishing tests don’t work. Not sure who those researchers are, but they are either doing the tests wrong or have bad data. I work with around 100 different companies and run these campaigns for the ones who opted to have them, there’s a clear difference in the awareness of users watching out for these scams. Done right, phishing tests work very well.