How do you usually conduct a safe phishing exercise to test the staff's security awareness? How do you ensure that staff are not offended by such an exercise? Would you in some circumstances also include the CEO without letting him/her know about it?
I think in some areas it's quite a controversial thing to do in an organization. I am trying to find out if it's suitable for us to perform one for our organization to raise awareness.