Or just report their mandatory compliance emails as phishing attempts.

I’ve worked for multiple large companies where the annual IT security signoffs look exactly like malicious emails: weird formatting; originates from weird external url that includes suspicious words; urgent call to action; and threats of discipline for non-compliance.

All this money being spent on training, only to immediately lull users into accept threats.