Phishing simulations can reduce risks, but their impact depends on relevance, ongoing training, and a supportive security culture.| Help Net Security