Phishing simulations are worse than useless Why we keep ignoring the data that phishing simulations don't have a meaningful impact on security - and what we should be doing instead.