How Do You Handle Clicks on Phish Links?

It's not uncommon that through either URL Rewriting or someone reporting a phishing attack, I find an individual who clicked on a link in a phishing email, which took them to a phishing form, typically trying to steal their username and password.

When the user has NOT entered any credentials, how do you handle these? Do you force a password reset anyway? Reset login tokens? Wipe computer? Force the end user into a phishing training program?

Again, this is not …

attack clicks credentials cybersecurity email find link links password phish phishing phishing attack reporting steal uncommon url username