Topic starter
11/11/2026 6:05 pm
TL;DR: When risky user actions are blocked, Panaseer says the most useful signal is whether the organisation still maintains a full block rate while the count trends down over time. For practitioners, the real test is whether security education is reducing non-compliant behaviour rather than merely inflating block totals.
Editorial analysis by NHI Mgmt Group, based on content published by Panaseer: “Blocking user non-compliance: the security metric to stop risky behaviour”.
Key questions
Q: Why do block counts not prove that a security programme is effective?
A: Block counts only show how many attempts were stopped, not whether users changed behaviour or the programme reduced risk.
Q: How does reporting a phish help defenders more than simply not clicking?
A: Reporting a phish gives defenders indicators such as sender details, URLs, attachment hashes, and mailbox telemetry, which improves triage and containment.
Q: How do I measure whether security awareness is reducing risky user behaviour?
A: Measure change in risky actions, not course completion.
Practitioner guidance
- Set block-rate baselines by behaviour type Separate risky clicks, downloads and sent emails into distinct measures, then track each against a pre-change baseline so improvement means fewer interventions over time.
- Promote reporting as the preferred positive action Measure and reward users who report suspicious messages, because report behaviour shows awareness and gives a better maturity signal than click suppression alone.
- Compare metrics to the previous period Show every security behaviour measure against yesterday, last week, last month or last quarter so leaders can see whether the curve is improving, flat or deteriorating.
Bottom line: Block-rate metrics are only meaningful when they are read as behavioural indicators, not as a simple tally of prevented actions.
Glossary terms: Block Rate, Trend Baseline, Continuous Controls Monitoring, Security Awareness Training
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/11/2026 6:06 pm
Block volume is an output, not an outcome. The fact that a control stops more events does not prove the organisation is safer if the same behaviour continues underneath it. Mature measurement has to distinguish enforcement activity from behaviour change, otherwise security teams end up optimising for visible friction rather than reduced risk. The practitioner conclusion is to treat block counts as supporting evidence, not the primary success measure.
A question worth separating out:
Q: What is the best way to use continuous controls monitoring for user behaviour metrics?
A: Use continuous controls monitoring to collect the same user behaviour metric repeatedly, automatically, and against a defined control objective. Feed access logs, email events, and policy exceptions into a baseline so deviations, not single counts, drive review. Pair it with thresholds, alerting, and manual validation for false positives.
👉 Read our full editorial: Why block-rate metrics matter for security education and improvement