An awareness and training programme is working when users complete required training and show better security behaviour over time. Evidence includes attendance and completion records, quiz or assessment results, phishing susceptibility trends, fewer policy violations, and faster reporting of suspicious activity. Measure whether the programme changes behaviour, not just whether it was delivered.
What counts as evidence that the programme is changing behaviour?
Good evidence goes beyond delivery metrics. Completion rates and attendance show reach, but the stronger signal is whether employees behave differently after training. Look for a sustained improvement in security decisions, not a one-time spike after a campaign. That means tracking whether people remember, apply, and repeat the right actions when they face phishing, data handling, or policy choices.
A useful way to judge performance is to separate knowledge gain from behaviour change. Quiz scores can show understanding, but they do not prove transfer into the workplace. Better evidence includes fewer risky clicks, more correct reporting, fewer repeat policy breaches, and less reliance on follow-up corrections. Over time, those measures should move in the same direction as awareness matures.
Training also needs to be assessed against the risks it is meant to reduce. If a programme is aimed at phishing resilience, then reporting speed, simulation outcomes, and user escalation quality matter more than generic completion data. If it is aimed at policy compliance, then violations, exceptions, and manager escalation patterns are the right indicators. The evidence should match the behaviour you want changed.
Which metrics show the programme is working over time?
The most persuasive measures are trend-based, not one-off snapshots. A working programme usually shows improving phishing resilience, fewer repeat mistakes, higher completion of required modules, and faster reporting of suspicious activity. It should also show that risky behaviour declines after reinforcement and that gains hold across business units rather than only in a single team or month.
Some metrics are more diagnostic than others. High completion with unchanged click rates suggests the content is being delivered but not absorbed. Strong assessment scores with weak reporting behaviour suggest people know the right answer but are not acting quickly under pressure. A reduction in policy violations, especially repeat violations, is often a better indicator of real behaviour change than awareness survey results alone.
When the programme is mature, look for operational signals that it is becoming part of everyday work. That can include more user-reported suspicious messages, fewer unnecessary escalations, cleaner handling of sensitive data, and fewer exceptions that stem from simple mistakes. For practical context on awareness metrics and human risk management, see the Security Awareness and Human Risk Management Guide.
How should you interpret weak or misleading results?
Some results look positive but do not prove the programme is effective. Very high training completion can hide poor engagement if the material is rushed or ignored. Quiz pass rates can be inflated if the questions are too easy. Phishing simulation improvements can also be misleading if users learn the test pattern rather than the underlying behaviour you want them to adopt.
A second common problem is measuring only at the point of delivery. If you do not compare pre- and post-training behaviour, or if you do not track repeat behaviour over time, you cannot tell whether the programme changed habits or simply created a short-lived response. The same applies to department-level averages, which can hide pockets of persistent risk.
Security awareness is most credible when it is treated as a human risk control, not a communications exercise. That means using evidence that shows behaviour under realistic conditions, then adjusting the programme when the data shows a gap between knowledge and action. A practical comparison of how organisations evaluate training platforms and behaviour outcomes is the Security Awareness Training Buyer’s Guide.
Risk and Threat Considerations
Awareness programmes fail when they become compliance theatre. The main risk is false confidence: leaders see completion data and assume the organisation is safer, while the same users keep clicking, reusing unsafe habits, or delaying reports. Attackers benefit when training does not translate into faster detection, lower susceptibility, or better escalation behaviour.
Failure mechanism: The programme measures participation instead of behavioural change, or it reinforces recognition without improving real-world response. Repeated exposure to low-quality simulations can also train users to ignore warnings rather than act more carefully.
Impact: The organisation keeps paying for training without reducing phishing success, policy breaches, or delayed incident reporting, which leaves preventable exposure in place.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-14 — Security Awareness and Skills Training | Directly governs awareness training effectiveness and behaviour change evidence. |
| Recommendation — Track completion, phishing response, and repeat violations to verify training changes user behaviour. | ||
| NIST CSF 2.0 | PR.AT-01 — All users are informed and trained | Applies because the question asks how to show users were trained and improved over time. |
| DE.CM-09 — Personnel are trained in cyber awareness and response | Supports ongoing measurement of awareness outcomes and response behaviour. | |
| Recommendation — Measure whether training changes user actions, not just whether it was delivered. Use trend data from reporting and user behaviour to confirm awareness is taking hold. | ||
Practitioner Guidance
What to verify: Validate that the metrics used by the programme are tied to the specific behaviour the training is meant to change. If the goal is phishing resilience, require evidence of reporting speed, reporting quality, and repeat susceptibility, not just course completion.
What to measure: Use a small set of stable measures over time, such as completion, assessment performance, suspicious-message reporting, repeat offenders, and policy violation trends. The best signal is a durable shift in behaviour after reinforcement, not a single good month.
Common mistake: Treating awareness as complete once the module is assigned or passed. If behaviour does not improve, the content, cadence, audience targeting, or reinforcement method needs revision.
Practitioner takeaway: A working awareness programme is one that changes what people do under pressure, so the decisive evidence is behavioural trend data, not training delivery data alone.
Related resources from NHI Mgmt Group
- How do security teams know if security awareness training is actually working?
- What is the difference between generic security awareness training and a human risk management programme?
- Why does a positive, branded security awareness programme tend to work better than generic compliance training?
- How can security teams tell whether a training vendor is actually protecting programme evidence?