Security problems can arise if staff cannot distinguish between simulated phishing messages, and real phishing messages that are sent by attackers, because staff might interact with a real phishing message (e.g. open the attachment, follow the link, etc.) The situation can also become more complex because (a) it is now possible for staff to get feedback on which messages were simulated and real, (b) simulated and real phishing messages identified in time can be reported, and (c) staff who have fallen for a simulated or real phishing message can be toldFootnote 13.