Phishing is the low hanging fruit and as such, we run continuous phishing campaigns to educate employees on how to detect malicious emails and also on how to report them.  Our campaigns run quarterly with each user's experience often differing from another in order to truly understand the level of knowledge throughout an organization.