Forgone bonus was just an example. It could be any sort of penalty or loss of perk, and my question is directed at the stead state equilibrium of the job market, not at behavior given whatever contracts are currently signed. E.g., instead of offering someone $85k, offer them $84k plus a $1k bonus if they avoid phishing attacks. Or give a bonus vacation day to each employee who passes the test. Etc.