Approximately 12% because you subtract 40% then 50% sequentially from 20% (20% − 40% = negative so assume floor at 0%), and therefore the realistic remaining attack rate is around 12% after adjusting for implementation loss, which is a conservative practical estimate a policy maker might choose.