I failed that for a couple years because I didn't report them.

once I figured that out I started to report every email that wasn't project related.

they asked me to stop, I told them no-can-do because I don't want to get dinged for not reporting phishing tests.

they changed their criteria after that 🤣