There are commercially-available off-the-shelf phishing training services, such as <a href="https:&#x2F;&#x2F;www.knowbe4.com&#x2F;phishing-security-test-offer" rel="nofollow">https:&#x2F;&#x2F;www.knowbe4.com&#x2F;phishing-security-test-offer</a> .<p>Disclaimer: My employer has used this, but I was uninvolved with the choice and have no stake in knowbe4. Just using it as an example I have to hand. I believe there are quite a few choices.