Security awareness metrics: what actually reduces breach risk?

TL;DR: Security awareness metrics should measure behaviour change, not training completion, according to Hoxhunt, with reporting rates, dwell time, repeat-clicker improvement, and real threat reporting giving a truer view of whether a programme is reducing breach likelihood. Completion data still helps with compliance, but it cannot show whether employees are actually protecting the organisation.

Editorial analysis by NHI Mgmt Group, based on content published by Hoxhunt: “Security Awareness Metrics That Matter: Predicting Breach Reduction”.

Key questions

Q: What should security teams do first when training completion looks high but incidents keep happening?

A: Start by replacing completion as the headline KPI with behaviour measures such as reporting rate, dwell time, and real-threat reporting.

Q: Why do reporting rates matter more than click rates in phishing assessments?

A: Reporting rates show whether employees are actively identifying and escalating suspicious messages, which is a stronger indicator of resilience than click rate alone.

Q: Why do security awareness programmes fail to create a strong security culture?

A: Awareness programmes often fail because knowledge does not reliably change behavior.

Practitioner guidance

• Focus executive reporting on behaviour change Replace completion-led dashboards with reporting rate, dwell time, real-threat reporting, and repeat-clicker trend lines so leaders see whether the programme is reducing risk rather than documenting attendance.
• Measure how fast people report suspicious activity Track time from message receipt to first user report, then compare it by team, role, and business unit to identify where the organisation still has invisible risk.
• Calibrate simulations to role and difficulty Use realistic lure types, role-relevant scenarios, and varying difficulty so campaign scores reflect actual behaviour instead of easy-to-game test design.

Bottom line: Security awareness measurement is most useful when it shows whether people help stop attacks, not whether they finished training.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →