Small and Medium-sized Enterprises are particularly vulnerable to cyberattacks. A large-scale field experiment amongst SME employees showed that a phishing test is effective in the short term, but not in the medium or long term.
This experiment is listed in the BINN report "A wealth of behavioural insights - 2023 edition". Further information on the trial and authors may be available elsewhere.