Don’t do this. Not unless you’re planning to actually give everyone the big bonuses along with the very-definitely-mandatory apology you owe them.
What I find particularly amazing is that the people defending this claim prominently to be "CISSPs", a credential issued by an organization that regularly makes holier-than-thou pronouncements about it's "ethical" requirements. Sounds like the compass needs some re-adjustment.
In other words, yes, I think less of you if you defend this kind of crap.
The problem is that the designers of this “test” (and those defending it) fail to recognize preventing phishing as only one of a large number of values that have to be balanced. If you lack the intuitive judgement to recognize the potential for harm, don’t run security tests.
For example, you shouldn’t send “test" email claiming that an employee’s loved one has been in an accident, even though criminals might sometimes do that, too.
Share this Scrolly Tale with your friends.
A Scrolly Tale is a new way to read Twitter threads with a more visually immersive experience.
Discover more beautiful Scrolly Tales like this.