For the past three years I have been sending out quarterly emails out about email security, common scams, how to ensure an email is from who it says it's from, Think Before You Click, and all that good stuff. Then, this year, we decided that wasn't enough so we purchased a KnowBe4 package, ran a phishing campaign on all staff to establish baseline test, and then assigned an email Security Awareness Training video to everyone via our LMS. My boss, the CEO, and select few other administrators know about the KnowBe4 campaigns at this point.
So, after all that, when I get this email forwarded to me from the CEO asking if it's real or not, I feel like I have failed on some level.
Cue facepalm, shaking my head, headdesk, etc, etc.