noted for my phishing business: track first phishing attempt, send follow up email two days later saying the first one was legit.

Note, this only worked because the follow up email came from the head of the division.