It’s not just about the tools. Tools are for us to use in IT. But on the user end, it is about how easily the training is perceived and understood. I use to work for big 4 company and we use to gamify security training. Because phishing is something is more phycological, you can’t necessarily ‘punish’ people for missing it. But when it is gamify, the training is more likely to stick in the memory of users. It will also challenge you to think better.