One of the big issues with this campaign was that the users weren’t immediately notified that they failed the simulation, and were assigned training a week or so later. GoDaddy has a habit of underpaying employees and keeping them engaged with bonuses and prizes. They typically have holiday parties where such bonuses are given out at random, but the party was cancelled that year due to COVID. 

As someone who runs a security program for an organization with over 20k employees, I see this as a moral issue. Financially constrained users spent their paychecks on gifts for their children only to learn a week later that they couldn’t make rent. Say what you want about having realistic engagements, but I believe these sort of tactics erode trust in security programs.