Organizations should be spear phishing their employees using LLMs to test defenses and identify gaps in security awareness training and processes.