Field note 01 · Human risk
What should we measure after security awareness training?
Three measures I’d track over six months to see whether employees recognize, report, and respond to suspicious messages.
A completion report can tell me who finished a security awareness course. The operational question comes later. When a suspicious message arrives during a busy workday, does someone recognize it, know where to report it, and take action quickly enough for the security team to respond?
I’d build a six-month review around three measures. Each one tells a different part of the story, so I’d read them together before deciding where to intervene.
1. Susceptibility
Track the share of employees who take a defined risky action in a simulation. I’d record clicking a link and entering credentials separately because they represent different behaviors. Use the number of employees who received the simulation as the denominator, and agree on the definitions before the first round.
Document what the message asked employees to do, how plausible it looked for their role, and how it was delivered. If the first exercise was an obvious phishing attempt and the second mimicked an internal payment request, a rise in failures could reflect the change in difficulty.
2. Reporting rate
Track the share of employees who use an approved channel to report a simulation. Count each person once and record the number of employees who received the exercise. A rising reporting rate can be valuable even when the risky-action rate is flat. It gives the security team a reason to look at both behaviors before changing the training.
3. Time to report
Track the median time from delivery to the first valid report for each employee who reported. Show the reporting rate alongside it. A fast median means something different when only a handful of employees reported. For an operations team, the time of the first report for the campaign can also help show when triage could have started.
What I’d review after six months
Start with a baseline and repeat comparable exercises at roughly one, three, and six months. Record changes in reporting tools, staffing, reinforcement, and scenario difficulty. A trend is easier to interpret when you can see what changed between rounds.
If reporting rises after a reminder and falls by month six, I’d check whether employees still know how to report and whether the reporting button is easy to find. If the data point to friction in the workflow, the next change might be making that button easier to reach. Then I’d measure again.
That’s the question I’d bring to the review with leadership. Which behavior changed, how long did it hold, and what should we do next?
Continue the conversation
What does your team measure after security awareness training? Share what has worked for you or tell me what has been hardest to measure.
Connect with me on LinkedIn