I’ve “failed” phishing tests because my email client loads images by default. The way they set it up.

I reported the “you failed a phishing test” email as a phishing attempt, and funnily enough they backed off on the “mandatory training”.

Bottom line, don’t set your employees up for failure. Even the tech literate are going to fail if that how you set shit up.