## 2 Literature Review
This ensures a high degree of efficiency and effectiveness, maximizing the return on investment for SMEs with limited training budgets. For example, KnowBe4 offers a library of training modules that can be customized to address specific industries and attack vectors faced by SMEs [14]. Similarly, Cybereason Security Awareness Training provides a modular platform with bite-sized learning modules that can be easily integrated into busy employee schedules, promoting accessibility and knowledge retention [15]. Furthermore, many platforms incorporate gamification elements to enhance engagement and knowledge retention. Interactive elements, such as points, badges, and leaderboards, can make the training process more enjoyable and impactful, fostering a more positive learning experience for employees [16]. PhishLabs offers gamified phishing simulations that allow employees to test their skills in a safe environment, identifying potential weaknesses and areas for improvement [17]. Beyond online training platforms, companies offer services to create and deliver clear and engaging cybersecurity awareness content specifically tailored to SMEs. This includes the development of courses, presentations, and video content that is aligned with the specific needs and language of the target audience within an SME [18]. Wombat Security Awareness Training, for instance, developscustomized training materials that resonate with employees at all levels within an organization [19]. Additionally, companies like InfoSec Institute Security Awareness Training offer engaging social media campaigns specifically designed for various platforms, leveraging these channels to reach a wider audience within the organization and raise overall cybersecurity awareness [20]. Phishing simulations, another service offered by many content creation companies, allow SMEs to test employee preparedness and identify areas where additional training or awareness campaigns may be needed [21]. The limited cybersecurity expertise within SMEs is another significant challenge highlighted. Consulting firms offer services to assist SMEs in developing and implementing effective cybersecurity strategies, addressing this critical gap. Needs assessments, a core service offered by these firms, identify the specific cybersecurity risks and vulnerabilities faced by an SME, providing a foundation for creating a customized cybersecurity strategy [22]. Consulting firms like PwC Cybersecurity Services utilize needs assessments to inform the development of tailored cybersecurity policies and procedures for SMEs [23]. These well-defined policies ensure consistency and compliance within the organization, empowering employees to make informed decisions regarding cybersecurity practices. Additionally, consulting firms offer incident response planning services, which involve developing a plan for how to respond to a cybersecurity incident. A well-defined incident response plan minimizes downtime and potential damage, allowing for faster and more effective mitigation strategies in the event of an attack. KPMG Cybersecurity and Deloitte Cyber Risk Services are just a few examples of consulting firms offering incident response planning services tailored to the specific needs of SMEs [24]. Commercially available solutions complement academic research on cybersecurity training for SMEs. From online platforms with customizable training modules to awareness content creation and consulting services, these solutions address the unique challenges faced by SMEs and empower them to build a more robust cybersecurity posture. By leveraging a combination of these solutions alongside academic insights, SMEs can create a comprehensive and effective cybersecurity training program for their non-technical employees. While much of the existing literature emphasizes the cybersecurity vulnerabilities of SMEs, it is increasingly evident that these issues are not exclusive to smaller organizations.