Which is also why we, collectively, as an industry needs to not put up with that. It's easy for me to say from the comfort of it not being my job on the line, that if this happens to anybody they should quit and then name and shame the company, but a competent security team is going to have the idea of doing a fake phishing interview and then not do it because of how morale destroying that would be. The security awareness team sending fake phishing emails are embarrassing enough.