Wouldn't that add additional noise to each employee work and thus could potentially be more costly than phishing e-mails themselves?