Ironically, this makes spotting the security team’s phish-testing emails even easier, because they don’t have the warning header or middleman-obfuscated URLs.