The metric for success shouldn’t be a high number of end users reporting phishing emails, but that seems to be what upper management wants to see, which just incentives less resources invested in better scanners with less than a 20% false negative rate.
The eternal battle between the “oh we go by data backed metrics, much measured, I feel this is the best” executive suite and the poor saps beneath twirling the data backed signs going ignored until money or disaster strikes.
Pity businesses aren’t formed from the bottom up; it’s like an octopus deciding not to listen to its arm brains until the shark has a bite of its head.