KnowBe4's formulas for risk reduction simply work. Being a technical company, our initial phish-prone percentage wasn't super high, but it was still around 18%. Since we have been requiring ongoing training and simulated phish testing, our average phish-prone percentage hovers in the 0 to 3% range now.