In this chapter, Bob discusses best practices on how often an organization should conduct phishing campaigns and who to target.