39% of organizations that ran smishing simulations reported that up to half their employees clicked on a malicious link.