Use miss rate to find people who neither click nor report, because they are effectively invisible in many awareness dashboards. Then compare that group with repeat clickers and low reporters to see where the program is failing to create a reporting habit. That gives you a better target for intervention than training scores alone.
What disengaged users look like in awareness data
Disengaged users are usually not the loud failures in a phishing dashboard. They are the people who rarely click, rarely report, and often sit outside the usual training narratives because they generate too little signal. The practical clue is not just low quiz performance, but a low interaction pattern across simulations, reporting, and follow-up activity.
That is why miss rate matters: it surfaces the group that is effectively invisible in many awareness dashboards. Once that cohort is isolated, you can compare it with repeat clickers and low reporters to see whether the real issue is apathy, weak reporting habits, or a programme that is not reaching a specific audience segment.
Why miss rate is a better lens than training scores
Training scores tell you whether someone can answer questions in a controlled setting. Miss rate tells you whether they behave differently when the programme is trying to create an operational habit. Those are not the same thing, and awareness teams often overvalue the former because it is easier to measure and report.
A user can complete training, pass a quiz, and still remain disengaged if they ignore simulations and never report suspicious messages. In that case, the control objective has shifted from knowledge transfer to behaviour change, and the metric needs to follow the behaviour. That is also where low reporters become important, because the absence of reporting is often the more useful warning than a single click event.
How to segment the audience into useful intervention groups
A practical way to segment is to separate three patterns: repeat clickers, low reporters, and the miss-rate cohort that neither clicks nor reports. Repeat clickers tell you where risky judgement is persisting. Low reporters tell you where the habit to escalate suspicious activity has not formed. The miss-rate group tells you who is staying below the radar altogether.
These groups need different responses. Repeat clickers may need targeted remediation and closer manager involvement. Low reporters may need simpler reporting paths and reinforcement of the expected action. The miss-rate cohort often needs better visibility, because without a behavioural signal you cannot tell whether the problem is indifference, poor message reach, or a broken feedback loop. NHIMG’s Security Awareness and Human Risk Management Guide is useful here because it frames metrics, reporting behaviour, and culture as part of the same programme design.
Risk and Threat Considerations
Disengaged users create a measurement blind spot. If a large share of the workforce is neither clicking nor reporting, the programme can look healthier than it is, while suspicious messages continue to pass unnoticed and unreported.
Failure mechanism: The control fails when awareness measurement rewards completion and quiz scores more than observable behaviour, so the quietest users are treated as low risk even though they may be least engaged with reporting duties.
Impact: Security teams lose early warning value, attackers gain more room to operate through unreported messages, and remediation effort gets misdirected toward users who are visible rather than users who are actually detached from the programme.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8 and NIST CSF 2.0 set the technical controls, while ISO/IEC 27001:2022 and SOC 2 (AICPA) define the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-14 — Security Awareness and Skills Training | Awareness metrics and behavior change are central to this training subject. |
| Recommendation — Measure reporting behavior and target training where user behavior shows the weakest security habit. | ||
| NIST CSF 2.0 | PR.AT-01 — Awareness and Training is Conducted | The question is about measuring whether awareness work changes user behavior. |
| DE.CM-08 — Vulnerability information is monitored and communicated to relevant personnel and roles | Awareness programs depend on monitoring and communicating security-relevant user behavior. | |
| Recommendation — Use behavioral metrics, not quiz scores alone, to verify training is being absorbed. Monitor reporting and simulation outcomes to identify where user behavior is failing. | ||
| ISO/IEC 27001:2022 | A.6.3 — Information security awareness, education and training | The subject is directly about awareness program effectiveness and user engagement. |
| Recommendation — Assess awareness effectiveness by observable user behavior, not training completion alone. | ||
| SOC 2 (AICPA) | CC2.2 — Communicates internal control information | Awareness reporting metrics support control communication and oversight. |
| Recommendation — Use engagement metrics to show where control communication is not reaching users. | ||
Practitioner Guidance
What to measure: Track miss rate alongside click rate and report rate, then trend it by team, role, and campaign type. The useful question is not only who failed, but who never created any observable response pattern across multiple exercises.
Decision rule: If a user is a repeat clicker, treat that as a targeted coaching problem; if a user is a low reporter, treat it as a reporting-habit problem; if a user is in the miss-rate cohort, treat it as a visibility and engagement problem before assuming the training content itself is the issue.
Practitioner takeaway: The best intervention target is usually the group that produces no meaningful behavioural signal, because absence of response is often a stronger programme failure indicator than a poor quiz result.