Security awareness metrics: what actually shows risk is falling?

TL;DR: Security awareness programmes often plateau because they measure training activity, not exposure or behaviour, so completion rates and low click rates can create false confidence while untested users and high-risk roles remain hidden, according to Hoxhunt. The practical shift is to track reporting, detection, speed and concentration of risk instead of participation alone.

Editorial analysis by NHI Mgmt Group, based on content published by Hoxhunt: “We’re Running Security Awareness Training. Why Isn’t Risk Going Down?”.

Key questions

Q: What breaks when security awareness programmes rely on completion rates?

A: Completion rates break because they measure attendance, not behaviour change or exposure.

Q: Why do low phishing failure rates sometimes create false confidence?

A: Low failure rates can hide the much larger group that never meaningfully engaged with the simulation.

Q: How should security teams measure whether human risk management is actually reducing risk?

A: Use outcome metrics, not just participation data.

Practitioner guidance

• Shift from completion to exposure metrics Replace completion-only reporting with detection rate, reporting rate, time-to-report, repeat failure, and non-response tracking.
• Segment the workforce by risk concentration Break results out by role, privilege, email volume, and business criticality so that executive assistants, finance teams, and other high-exposure groups do not disappear into averages.
• Use continuous simulations with adaptive difficulty Run regular behaviour checks that adjust difficulty by user performance and reward reporting behaviour immediately so the programme measures real-world detection rather than pattern recognition.

Bottom line: Security awareness training can produce a polished dashboard without materially lowering human risk.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →