The last round my company did was pretty damn good. The email itself was well done and professional looking. They even registered a domain that was one letter different than the company name for the source email domain and the phishing form.

It was still one of those things that makes you hesitate like "your password has expired, click here to reset it" and the email client blatantly flagged it as being from outside our true domain. The client warning was the easy thing to spot, the rest was really well done.

[–] APassenger@lemmy.world 4 points 3 weeks ago* (last edited 3 weeks ago) (1 children)

That's the odd thing with where I work, until recently all the phishing simulations were from within the company domain and so lacked the [External...]

It's not impossible for an already infiltrated network, but I still expect to see that it came from outside. Maybe that's me, tho.

Wdits: spullings <- like those

[–] clif@lemmy.world 1 points 3 weeks ago

Wow, that is impressively sneaky to use the legitimate domain.