About two years ago, where I worked really amplified up their phisting testing, and after the first batch when SO MANY PEOPLE failed (I heard the number was around 60%), they pushed out a new HR policy that included a suspension/termination for repeated offenders.

Less than 3 months later, HR was begging people to click the link in their email to set up their benefits for the year, because they had a 0% click-through rate.