Completion rates break because they measure attendance, not behaviour change or exposure. A user can finish training and still make the same risky decisions, especially if they have privileged access or are being targeted by active threats. That is why benchmarking has to connect behaviour to identity and threat context before it is treated as a meaningful risk signal.
Why completion rates fail as a security metric
Completion rates tell you who attended training, not whether the programme changed judgement, reduced exposure, or reduced the likelihood of a bad decision under pressure. That is why they are a weak proxy for security performance: the metric sits one step too far from actual control effectiveness. A programme can look healthy on paper while risky behaviour stays unchanged.
The deeper problem is that awareness is only useful when it changes decisions in the moments that matter. If a user still approves a fraudulent request, still reuses a password, or still mishandles a sensitive action after training, the completion score did not capture the failure. The measure also misses context, for example whether the person had NIST Cybersecurity Framework 2.0 style governance around critical behaviours, or whether the training touched the actual threats facing the role.
Completion metrics also flatten the difference between low-risk and high-risk populations. A frontline user and a privileged administrator may both show 100 percent completion, yet the second profile carries far greater blast radius if they make one wrong decision. That is why completion should be treated as an administrative record, not as proof that risk has declined.
What should be measured instead of attendance
Better measurement starts with behaviour tied to observable risk. For example, look at phishing reporting rates, suspicious link interaction, MFA prompt acceptance, secret handling errors, and escalation behaviour when a user encounters something abnormal. Those indicators are closer to whether the person can recognise and respond to a real threat.
Role context matters as much as the metric itself. A meaningful benchmark should segment results by privilege level, business function, and exposure to active threat activity. This is especially important for privileged or service-linked access paths, where a single poor decision can have outsized impact. If the organisation cannot connect the metric to the identity holding the access, the benchmark is probably too coarse to guide action.
External reference points are useful when they help define the control objective. For example, ISO/IEC 27002:2022 Information Security Controls is helpful when you are translating awareness into operational control expectations, while NIST SP 800-53 Rev 5 Security and Privacy Controls is useful when the programme needs to support formal control outcomes rather than training vanity metrics.
How to benchmark awareness with real security signal
The practical benchmark is not “who completed training”, but “what changed after training, and under what conditions”. That means comparing pre- and post-training behaviour, then validating whether the change holds in the same role, threat, and access context. A score only matters if it predicts safer action in the environments where people actually work.
Use a small set of outcome measures, then keep them stable enough to trend over time. If a programme keeps changing its definition of success, leaders lose the ability to tell whether controls are improving or merely being renamed. One useful approach is to align awareness data with exposure data, such as which teams face frequent phishing, which roles have elevated privilege, or which users repeatedly trigger risky events.
For organisations building stronger governance around that relationship, NIST Cybersecurity Framework 2.0 offers a broad structure for governance and protective outcomes, and ISO/IEC 42001:2023 AI Management System Standard is relevant when awareness is being extended into AI-assisted workflows where users may overtrust automated output.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.OC-03 — External Contexts | Awareness metrics must reflect the business and threat context of the roles being measured. |
| PR.AT-01 — Awareness and Training | The subject is the limits of awareness training as a control outcome. | |
| GV.RM-01 — Risk Management Objectives | Completion rates fail when they are used as a proxy for actual risk reduction. | |
| Recommendation — Tie awareness metrics to role exposure and threat context before treating them as risk indicators. Measure behaviour change, not course completion, when evaluating awareness training. Define awareness success in terms of risk reduction outcomes, not attendance rates. | ||
| NIST SP 800-53 Rev 5 | AT-2 — Security Awareness Training | The question is about what awareness programmes can and cannot prove. |
| CA-7 — Continuous Monitoring | Behaviour-based benchmarking requires ongoing measurement, not one-time completion data. | |
| Recommendation — Assess whether training changes user behaviour before treating completion as effective. Monitor user behaviour trends continuously to validate awareness effectiveness. | ||
Practitioner Guidance
What to prioritise: Replace completion reporting with a behaviour-linked dashboard that separates routine users from high-privilege roles. If the programme cannot show different outcomes for different exposure levels, it is not yet fit for risk management.
What to verify: Check whether the training topic matches the actual failure mode you want to reduce. A module on generic phishing has limited value if the dominant losses come from privilege misuse, unsafe approvals, or secret handling mistakes.
Common mistake: Treating 95 percent completion as proof of resilience. The more useful question is whether risky decisions declined in the months after training, especially in the same populations that would cause the largest impact if compromised.
Practitioner takeaway: Awareness only becomes a security control when it changes measurable behaviour in the context of real access and real threat exposure. If you cannot connect the metric to decisions, privilege, and observed outcomes, it is reporting activity, not reducing risk.
Related resources from NHI Mgmt Group
- Why do completion rates fail as audit evidence for security awareness programmes?
- What breaks when security awareness programmes rely on point-in-time assessments?
- What breaks when security programmes rely on patching as the main defence?
- What breaks when security teams rely on dashboard completion instead of validation?