Disclosure: I work at SafeInstinct, which sells security awareness training. We published this partly because the evidence base for our own category is weaker than the marketing suggests.