That's the odd thing with where I work, until recently all the phishing simulations were from within the company domain and so lacked the [External...]

It's not impossible for an already infiltrated network, but I still expect to see that it came from outside. Maybe that's me, tho.

Wdits: spullings <- like those