A small business can find out how well its cybersecurity training is working by giving regular tests like quizzes, simulated phishing attacks, and feedback polls to see where people don't know enough and where they can improve.