My workplace does simulated phishing emails every Friday. If you click on them, they make you do training. Last month, someone's email was breached and they started sending out tons of phishing emails, the users reported it en masse and we had dozens of reports within minutes - and these emails went out at 10PM on a weekend! Seems like our training works.