Employee susceptibility to phishing dropped to 4.7% and 4.5% respectively in small and medium-sized retail organisations after one year of continuous training.