No, because by giving names you are assigning blame and security needs to move away from blaming individuals and instead take it as a whole. It's the same as finding a security vulnerability in a web site. You shouldn't blame the developer but should instead look to improve the entire process.

We run phishing campaigns and do not identity users. What we use it for is to identity weakness on our part and that we need to train our staff better. There is no point focusing this training on just a single person.

After a campaign we email all staff provide the statistics of failures / success and then provide tips for spotting phishing and how to treat email in general.

No, because by giving names you are assigning blame, security needs to move away from blaming individuals and instead take it as a whole. It's the same as finding a security vulnerability in a web site: you shouldn't blame the developer but should instead look to improve the entire process.

We run phishing campaigns and do not identify users. What we use it for is to identify weakness on our part and that we need to train our staff better. There is no point focusing this training on just a single person.

After a campaign we email all staff, provide the statistics of failures / success, and then provide tips for spotting phishing and how to treat email in general.

No because by giving names you are assigning blame and security needs to move away from blaming individuals and instead taking it as a whole. Its the same as finding a security vulnerability is a web site - you shouldnt blame the developer but instead look to improve the entire process.

We run phishing campaigns and do not identity users. What we use it for is to identity weakness on our part and that we need to train our staff better. There is no point focusing this training on just a single person.

After a campaign we email all staff provide the statistics of failures / success and then provide tips for spotting phishing and how to treat email in general.

No, because by giving names you are assigning blame and security needs to move away from blaming individuals and instead take it as a whole. It's the same as finding a security vulnerability in a web site. You shouldn't blame the developer but should instead look to improve the entire process.

We run phishing campaigns and do not identity users. What we use it for is to identity weakness on our part and that we need to train our staff better. There is no point focusing this training on just a single person.

After a campaign we email all staff provide the statistics of failures / success and then provide tips for spotting phishing and how to treat email in general.