James Langevin actually said...
I think best practices that I have seen in private industry have been around training programs where you actually create test-phishing campaigns.
Context
Langevin discusses effective training programs to combat phishing attacks.
02/25/2019