Cyber awareness metrics that measure behaviour, not just compliance

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Panaseer's blog post: Cyber awareness programmes fail when organisations measure compliance outputs instead of the human behaviours and control context that shape real risk.

Why it matters: IAM, NHI and security leaders need culture metrics that explain whether people act as a security asset or a liability, especially where access, training and behaviour intersect.

By the numbers:

• 90% of successful cyber-attacks can be traced to human error.

Context

Cyber awareness culture is the difference between a programme that records attendance and a programme that changes behaviour. Basic measures such as training completion and phishing click rates can show activity, but they do not show whether people understand the policy, trust the message or act differently when the pressure is real.

The governance gap is measurement quality. If data is taken from a single tool, it lacks the context needed to judge whether awareness is improving or merely being reported. That matters for identity governance too, because people with access to critical systems can only be treated as a security control if the organisation can see how they actually behave.

Key questions

Q: How should teams measure cyber awareness culture beyond click rates?

A: Teams should combine behaviour, confidence and context rather than relying on one-off quiz scores or phishing clicks. Useful measures include response confidence, time to answer, training completion, auto-lock behaviour and whether high-risk users are actually covered by the right controls. The goal is to see whether awareness changes decisions in practice.

Q: Why do phishing simulations fail to show real security culture?

A: Phishing simulations fail as a culture measure because they mainly test click behaviour in a controlled exercise, not how people detect, report, and escalate suspicious activity in real work. A mature security culture shows up in reporting rates, timely escalation to SOC or IAM teams, respectful challenge of unusual requests, and lower tolerance for risky workarounds, not only in simulated failure rates.

Q: What is the difference between security awareness and security culture?

A: Security awareness is what people know about threats, policies, and safe behaviours. Security culture is what people actually do under pressure, shaped by leadership, incentives, reporting channels, and whether controls such as MFA, least privilege, and approval workflows are easy to follow and consistently enforced.

Q: How do continuous control data and human risk metrics work together?

A: Continuous control data shows whether controls are working, such as MFA coverage, privileged access reviews, patch status, and logging completeness. Human risk metrics show how people behave, such as repeated policy breaches, phishing reports, or excessive access requests. Used together, they connect control effectiveness with the human behaviours that create residual risk.

Technical breakdown

Why click rates do not measure culture

A phishing click rate is a single event metric: it tells you whether someone clicked, not why they did, how confident they were, or whether they would repeat the behaviour under different conditions. Culture measurement adds behavioural depth by looking at response time, confidence, trust, and consistency across assessments. That shifts the question from simple completion to actual judgement under pressure.

Practical implication: Measure confidence and response quality alongside clicks so you can distinguish genuine learning from accidental pass rates.

How control data gains context through correlation

Continuous Controls Monitoring becomes more useful when it combines awareness data with HR signals, auto-lock events and privileged access records. In isolation, each feed is narrow. Combined, they show whether new joiners were enrolled, whether people with sensitive access still leave devices unlocked, and whether training reaches the users who matter most. See the Security Awareness and Human Risk Management Guide.

Practical implication: Correlate awareness signals with access and lifecycle data before using them in risk reporting or intervention planning.

Why screen-lock behaviour matters to security culture

Automatic screen locks are not just a convenience setting. They are a proxy for whether people internalise basic policy and apply it when supervision is absent, especially in hybrid and home-office settings where informal oversight is weaker. Repeated failures here often indicate that policy has not been made meaningful enough for daily work.

Practical implication: Track unattended-session behaviour as a culture signal, then target the teams and scenarios where the habit is not sticking.

Threat narrative

Attacker objective: Exploit human error to gain trusted access, bypass normal scrutiny and reach sensitive systems or data.

1. Entry begins with a user interaction failure, often a phishing click, weak judgement, or unattended session that gives the attacker an opening.
2. Credential access follows when that human lapse exposes credentials, authorises a malicious action, or leaves a system open long enough for misuse.
3. Escalation and impact occur when the attacker uses the human weakness to reach higher-value systems or data, turning a local mistake into broader compromise.

Breaches seen in the wild

• CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Cyber awareness only becomes governable when it is measured as behaviour, not attendance. Completion rates and click counts are useful, but they mostly prove that a process happened. They do not prove that people understand why the process matters or that they will behave differently when pressure rises. The practical conclusion is that awareness programmes need behavioural evidence, not just audit evidence.

The strongest culture metrics are cross-signal metrics. Awareness data gains value when it is joined to HR lifecycle events, access data and device behaviour. That combination reveals whether the right people were trained at the right time and whether the controls they should follow are actually being used. Practitioners should stop treating training as a standalone dashboard and start treating it as one input into risk context.

Security culture and identity governance now overlap at the point of use. A person with privileged access who leaves a device unlocked, ignores guidance or guesses through training assessments is not just a human-risk issue, but a governance issue about how access is exercised in practice. human risk management is most effective when it informs access policy, not when it sits apart from it. The conclusion is to govern behaviour where identity and control intersect.

Modern culture programmes should look for meaningful confidence, not just correct answers. A worker who answers quickly and confidently but incorrectly is revealing a different risk profile from someone who is unsure but attentive. That distinction matters because overconfidence often predicts careless handling of email, sessions and policy prompts. The practitioner takeaway is to measure judgement quality, not simply right-or-wrong outcomes.

What this signals

Awareness programmes are drifting toward evidence-based governance. The next stage is not more training volume, but better signal quality: response confidence, behavioural consistency and cross-system context. Organisations that cannot join those signals will keep mistaking compliance output for reduced risk.

Human-risk telemetry should become part of access governance. When a programme can see who is trained, who is overconfident, and who leaves sessions unattended, it can start to govern how identity is exercised rather than just who has access. That is the point at which awareness becomes a control input instead of a communications exercise.

For practitioners

• Measure confidence alongside correctness Use assessment formats that record answer confidence and response time, then compare those signals against accuracy to find overconfident users or weakly engaged groups.
• Correlate awareness with access and lifecycle events Join training records, auto-lock telemetry, HR joiner-leaver data and privileged access logs so you can see whether the right people were exposed to the right controls at the right time.
• Treat unattended sessions as a culture metric Track how often devices move from active use to auto-lock, then investigate patterns by team, location and role to separate habit failure from policy failure.
• Use champions to reinforce local norms Identify respected people in each function who can answer questions, model safe behaviour and reinforce why the policy matters in day-to-day work.

Key takeaways

• Cyber awareness programmes become materially more useful when they measure behaviour and confidence instead of only completions and click rates.
• Combining awareness, HR and device telemetry gives the context needed to judge whether culture is improving or simply being reported.
• The operational goal is to turn human-risk data into access and policy decisions that reduce mistakes before they become incidents.

Related NHI Mgmt Group resources: Security Culture Measurement Guide · Security Awareness and Human Risk Management Guide · Security Awareness Plan Template · Security Culture

Key terms

• Continuous Controls Monitoring: Continuous controls monitoring is the ongoing evaluation of transactions, access, and configuration changes against policy rules. It replaces occasional sample testing with near-real-time detection, which gives security, audit, and finance teams faster evidence and a better chance to correct drift before it becomes a finding.
• Phishing Simulation: Phishing simulation is a controlled exercise that sends realistic but harmless lure messages to users to measure how they respond to credential theft attempts. In IAM and security operations, it tests awareness, reports risk patterns, and helps tune controls, training, and incident response for human and NHI attack paths.
• Auto-Lock: Auto-lock is a session control that locks a vault after a period of inactivity. It reduces the chance that an unattended browser session can be misused, especially in shared workspaces or on devices left open after administration. The control is only effective when the timeout fits operational risk.
• Cyber Awareness Culture: Cyber awareness culture is the shared set of attitudes and behaviours that shape how people recognise, report, and respond to security risk. It covers how employees, managers, and contractors handle phishing, data handling, access requests, and policy exceptions, and it is reflected in everyday compliance rather than training completion alone.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity and secrets management alongside the identity controls that support them. It is suited to practitioners who need a structured way to connect identity, access and operational risk.