At the McGrail Foundation, we believe that education is the best way to help users safer in a world of scams not testing users with fake phishes. For example, in September 2020, the Chicago Tribune wanted to test its cyber defenses by phishing their employees. The only problem? The phishing email offered employees a $10,000 bonuses only to link to a page that said they failed the phishing test. Employees were, understandably, up in arms. What did this test prove?