SMBs often lack rigorous security training, study finds.