I’m 100% so far at my job, but we had one test that tricked somewhere around 30% of employees. They spoofed everyone’s supervisor and made it look like an urgent Teams message was pending.
Usually, if you get phished you lose your bonus. They made an exception that one time.
To be fair, my job involves very sensitive medical data. We’ve seen entire businesses shut down because of data breaches.