Our company ran a phishing simulation. The email said: “Your password expires today. Click here to keep your account.” I clicked it. The page asked for my username and password. I entered both. Then it redirected me to a page saying: “Congratulations! You’ve been phished.” I closed the tab and went back to work. Ten minutes later, HR called me into a meeting. “Why did you enter your credentials?” “Because the email said my password was expiring.” “Didn’t you notice the suspicious sender address?” “No. It came from the IT department.” They showed me the sender. security-awareness@company-training.com I asked if that was our domain. Nobody answered. They told me to complete additional security awareness training. I completed it. The following week, I received another phishing simulation. This time, I reported it immediately. The security team congratulated me. I received a certificate. PHISHING AWARENESS CHAMPION — Q3 2026. My manager posted it on LinkedIn. The CISO commented: “Human firewalls are our first line of defense.” Three days later, I received an actual password reset email from IT. I reported it as phishing. IT locked my account. Apparently, the real password reset email came from a third-party identity provider nobody had told us about. I’ve now completed six hours of security awareness training. I still can’t log into my computer. But according to HR, I’m one of the company’s strongest human firewalls.