Comparatively, Cern does a phishing study from time to time [1] and the campaigns are in line with current expectations: People fall for phising, and security training has only a short term effect on phising. Unfortunately I can't find the real results right now.

We once had a bachelors thesis comparing the results over multiple years, and the results were mostly stable. (Years are mid 2010s).

[1] https://home.cern/news/news/computing/computer-security-cern...