Introduce attachment phishing tests. Send phishing emails which contain a .docx, .xlsx, .pdf or other attachments which could contain malicious payloads.