I think a handful of research examples. For instance, I used to work at a non-profit that does donor-based fundraising that apparently had an account compromised, and the bad actor just sat and waited until the right time.

Then, when a donor asked for details about how to contribute, that was when the attacker sent an email from the compromised account with instructions to wire to some outside account we had never heard of. It was caught right away and nothing bad happened but it was still too close for comfort.

I don't believe in the fatalistic assumption that it's impossible to communicate about. It happens to real people after all. But I think you have to be specific and have specific action steps in mind.