It's hard for a CyberSecurity team to be effective when the Execs keep failing the phishing tests and IT does not have the authority to fire them for it.
I've seen this so many times. I've seen instances where the execs/managers demanded it was turned off for them, and it was. 75% of the security I've seen at companies is pure theater so they can check the boxes for their insurance.