When was the last time you conducted a phishing simulation at your organization?

We run monthly campaigns with the exception of December and July (vacation periods) - Some divisions have prices for a department with 0 failures in a campaign...

While phishing exercises on the one hand are good.  They dont solve the core problem of the controls that didnt work that allowed something bad to occur in many cases