Nothing can take the risk to zero. The goal is to take steps to minimize that risk. The average “click rate” for phishing emails is something like 18% (don’t quote me on that exactly) and if you can institute training that brings it lower then you are working to minimize risk. You should do other things as well to further reduce risk, but training is one tool in the toolbox to help.