This is a problem that has been bothering me somewhat.
I am able to run a phishing simulation campaign against users across the organisation. If the user clicks on a bad link they are directed and told that they have made a mistake and that they should not have clicked. They are then offered some guidance on what the correct actions should have been through a webpage.
This all sounds great, but how can assurance be given to users it isn't a sophisticated phishing attack?
I have thought about using existing phishing material internally used, and have the link point to the intranet - is there a better way?