Am I misremembering, or isn't there research out that shows things like phishing and spam mail exercises have a net negative effect on organizational IT security?