Is there any solid research published on that? The anecdotal evidence I’ve heard from people at pretty large companies was that it only helped with a modest red

Is there any solid research published on that? The anecdotal evidence I’ve heard from people at pretty large companies was that it only helped with a modest reduction the lowest-skill phishing, whereas actually securing their systems had far more impact.