Phishing simulations are cruel and they don't work. They are weak administrative controls that IT should replace with strong technical controls, namely FIDO authentication. Stop blaming users for dangerous software products and unsafe configurations.