Training and simulations absolutely do reduce the likelihood of an event.

Most companies don't use these tools correctly, and certainly the technical audience here on HN will despise them. But phishing simulations can reduce your risk.