Evidence & Methodology
Every claim, explained.
We publish the numbers our marketing relies on — and the methodology behind each one. If you are evaluating IntelXview as a buyer, an auditor, or a regulator, this page is the source of truth for our headline claims.
Headline Claims
What the numbers mean.
Each figure below appears across our website, decks, and proposals. Each one has a defined construction.
847
Organisations researched
Distinct organisations across the IntelXview research base, accumulated through commercial engagements, audited public-record incident analysis, and partner research collaborations between 2022 and 2026. Organisations are counted once, regardless of headcount, region, or sector.
Source: IntelXview internal research base (NDA, available on request)
650,000+
Employees studied
Cumulative count of unique individual learners whose pre- and post-training assessment data sits inside the research base. Employees are counted at the point of enrolment, with re-enrolments deduplicated. Sector mix is biased toward regulated industries (financial services, government, healthcare).
Source: IntelXview internal research base (NDA, available on request)
73%
Retention rate (cohort mean, 30-day)
Mean post-training assessment score across the research base, measured 30 days after course completion using the same parallel-form question bank as the pre-training baseline. Reported figure is the cohort average; individual programmes range from 61% to 89% depending on incident type and audience.
Source: IntelXview cohort measurements. Per-programme range and 90% confidence interval available on request.
~12%
Reference baseline for annual scheduled awareness training
We use ~12% as a low-anchor reference for retention from annual, schedule-driven awareness training. This is an approximation we draw from the broader literature on the Ebbinghaus forgetting curve and from public reporting on annual training outcomes. We do not claim every vendor sees this number — we treat it as an order-of-magnitude reference, not a single-source benchmark.
Source: Reference points: Murre & Dros (PLoS ONE, 2015) — Ebbinghaus forgetting curve replication; Proofpoint State of the Phish (2024) and SANS Security Awareness Reports (2022–2024) for industry context.
~6×
Order-of-magnitude gap vs the reference baseline
Derived from 73% (cohort mean) divided by the ~12% reference baseline, rounded to one significant figure. We treat this as an order-of-magnitude comparison between incident-triggered and annual scheduled formats — not a precise multiplier for any individual programme. Procurement and audit packs cite the per-programme range instead.
Source: Derived figure. Per-programme retention range available on request.
Measurement Method
How retention is actually measured.
We treat retention as a measured quantity, not an opinion. Every cohort goes through the same four steps so that the numbers we publish at the top of the page are reproducible at the bottom of an engagement.
Pre-training baseline
Every learner completes a structured assessment before the course is delivered. The assessment is keyed to the specific incident type and the learner's role. Baseline scores anchor every subsequent measurement.
Post-training assessment
Immediately after course completion, learners take a parallel-form assessment drawn from the same question bank, with question order and distractors rotated. Immediate post-scores establish acquisition.
30-day retention measurement
The same assessment is reissued 30 days after completion. The 73% figure is the average score at this 30-day point — not at immediate completion. Retention, not recognition, is what we report.
Behaviour change tracking
Where the customer environment supports it, we layer assessment data with observed indicators such as reported phishing rates, helpdesk security ticket volume, and policy-violation incidents. Behaviour change is reported per programme, not in the headline number.
What We Will Not Do
The guardrails behind the headline.
A headline figure is only useful if buyers know what it does and does not claim. These are the four rules we apply when our own marketing is at risk of overreach.
We never quote a single customer outcome as the headline.
Individual customer programmes have produced higher retention figures than 73%. We do not use those numbers in the headline because they are not representative of the full research base.
We do not include self-reported confidence as 'retention'.
Self-reported confidence has its place in onboarding research. It is not what we mean by retention. Retention is measured against assessed knowledge using a parallel-form 30-day post-test.
We separate the headline figure from the assurance figure.
73% is the cohort mean. Where a procurement, audit, or board context needs the lower bound, we publish the per-programme range in the engagement readout. The headline does not pretend to be the floor.
The 12% reference is a baseline, not a competitor claim.
We do not compare to any individual vendor by name in the public claim. The 12% figure is drawn from the published research norm on annual scheduled awareness training. We will share the underlying references on request to procurement and audit teams.
In scope of the research base
- ✓Course content built from specific real-world incidents within 48 hours of public disclosure
- ✓Role-targeted assessments for SOC, IT, finance, operations, and executive audiences
- ✓Pre-training, immediate post-training, and 30-day retention testing
- ✓Behaviour-change indicators where the customer environment supports collection
- ✓Engagement readouts containing per-programme retention figures and 90% confidence intervals on request
Explicitly out of scope
- ✗Reskinning a vendor's annual awareness library with a fresh certificate
- ✗Phishing-simulation click-rate metrics presented as 'training outcomes'
- ✗Completion rates presented as retention
- ✗Self-reported confidence presented as knowledge
- ✗Vendor-anonymous case studies that cannot be cross-checked against the research base
Why timing helps
We don't make brain claims. We measure salience.
We deliberately avoid neuroscience claims about plasticity, stress hormones, or memory consolidation. The mechanism we rely on is simpler and easier to verify: training is delivered while the incident is still salient, when attention and relevance to the learner's own job are highest.
That salience window is what we measure against. Retention is tested against a parallel-form assessment 30 days after completion. If the figures held in our research base ever drift from the headline cohort mean, the headline number changes — not the methodology.
Public References
Named, peer-reviewed sources behind the claims on this page.
Each reference below is publicly accessible. Author, year, and outlet are named in full so any cold buyer, auditor, or regulator can verify what we cite without contacting us first.
[1] Forgetting curve / retention benchmark
Ebbinghaus forgetting curve — modern replication
Murre, J. M. J., & Dros, J. (2015). Replication and analysis of Ebbinghaus' forgetting curve. PLOS ONE, 10(7), e0120644. doi:10.1371/journal.pone.0120644.
Anchors the general claim that knowledge from a single, scheduled exposure decays rapidly over days.
[2] Annual awareness-training outcomes — directional context
Proofpoint, State of the Phish 2024; SANS, Security Awareness Report 2024.
Available at proofpoint.com/state-of-phish and sans.org/sareport-2024.
Used as directional context for outcomes from once-a-year scheduled awareness programmes. Not treated as a precise vendor-by-vendor benchmark.
[3] Salience and attentional weighting
Mather, M., & Sutherland, M. R. (2011). Arousal-biased competition in perception and memory. Perspectives on Psychological Science, 6(2), 114–133.
Background for the salience claim — that emotionally or contextually salient events bias attention and memory in their favour. Cited as background only, not as endorsement of any IntelXview outcome figure.
[4] 30-day retention testing methodology
Roediger, H. L., & Karpicke, J. D. (2006). The power of testing memory: Basic research and implications for educational practice. Perspectives on Psychological Science, 1(3), 181–210.
doi:10.1111/j.1745-6916.2006.00012.x.
Foundation for delayed-test (we use 30-day) retention assessment using parallel-form question banks. Underpins our measurement method, not the headline retention figure itself.
[5] IntelXview research base — internal, NDA
Internal cohort measurements
Covering 847 organisations and 650,000+ employees, 2022–2026. NDA-protected.
Sampling rules, deduplication logic, per-programme retention range, and 90% confidence intervals are released under NDA to procurement, internal audit, and regulators on request. The 73% cohort mean is computed from this base.
Read the engagements behind these figures in our case studies.
Want the audit-grade version?
Procurement, internal audit, and regulator engagements get a written evidence pack tailored to your framework. Tell us your context and we will respond within one business day.