Phishing campaigns barely do any good if they are well-prepared and accompanied with good communication in a company environment. Employees need to be aware of phishing tests and have to have a way of reaching out to those who conduct them. If you run phishing tests, employees need to be able to verify if what they have received is indeed part of a simulation or a real phishing mail. At the end of the day, phishing trainings just tell you who is already good at identifying suspicious emails. The training effect is negligible.

Without the support infrastructure of internal company communication, phishing your customers most likely leads to more confusion and open support tickets.