Launch a simulated phishing attack, and monitor user response to help you test and strengthen your defence where any individuals fall short.