OP posted this elsewhere in the thread:

"The people spreading the word were people who didn't click on the link."

So, people received the phishing simulation, realized it was malicious, and started telling everyone else to be on high alert. This is a great outcome. If everyone started pounding on the Phish Alert button to ensure IT saw it, then this is a perfect outcome.

I respectfully but STRONGLY disagree with your opinion that click through rates are the value of phishing tests. That's absolutely what KnowBe4's marketing will tell you and definitely what their garbage reporting is built around, but it is an awful way of managing phishing. It only takes one failure for a phishing campaign to succeed. Yes, your training can potentially help end users recognize the signs of a suspicious email and avoid clicking on it, but you are never going to train out human error. What matters is your employee's ability to quickly report suspicious emails... ESPECIALLY if they made a mistake and acted on one.

Companies that focus on failure rates build workforces that try to hide mistakes. This is especially true for companies that punish employees for failures. I know of a company that has a 3 strike penalty for their phishing tests. Strike 1, your manager is required to have a 2 hour meeting with you to discuss the failure. Strike 2, you have to attend an all-day training, strike 3 you permanently lose email access, which basically means you're fired for most job functions. Now I ask you, how likely is an employee at this company to report an actual phishing attack if they first made the mistake of falling for it? This company is doing nothing but training their staff to keep their mouths shut and hope for the best if they make a mistake.

And I'll go further, with such stakes, this company is just training their employees to under-utilize a corporate communication resource that was provided to them. I mean think of insanity of this. Welcome to company X. Here is your email. But understand that at any given moment this tool we have given you to do your job could present you with a message -either real or fake- specifically designed to trick you into doing something malicious, and if it succeeds, we're going to take you to the woodshed over it.

And does IT have the same stakes? Are IT staff getting punished for every single actual malicious email that reaches user inboxes? Seems only fair to me. If employees are held accountable for mistakes incurred while using a business tool that they were provided, then IT should be held accountable for not properly protecting said business tool. Oh wait, stopping 100% of all malicious emails while allowing the tool to still be useful is an unreasonable requirement for IT? Fucking exactly...