Follow The Data

From there you will be able to tell if they need more education on how to spot a certain type of phishing email.

There are 3 factors in determining whether you are going to create your own phishing training program or outsource the program.