Topic starter
24/10/2026 8:50 pm
TL;DR: Security awareness training can leave risk flat even when dashboards look healthy, because participation metrics measure attendance instead of exposure, according to Hoxhunt. Program owners need outcome signals that show where behaviour and identity risk still cluster.
Editorial analysis by NHI Mgmt Group, based on content published by Hoxhunt: “We’re Running Security Awareness Training. Why Isn’t Risk Going Down?”.
Key questions
Q: Why do low phishing failure rates sometimes create false confidence?
A: Low failure rates can hide the much larger group that never meaningfully engaged with the simulation.
Q: How should security teams measure whether human risk management is actually reducing risk?
A: Use outcome metrics, not just participation data.
Q: What breaks when security awareness programmes rely on completion rates?
A: Completion rates break because they measure attendance, not behaviour change or exposure.
Practitioner guidance
- Shift from completion to exposure metrics Replace completion-only reporting with detection rate, reporting rate, time-to-report, repeat failure, and non-response tracking.
- Segment the workforce by risk concentration Break results out by role, privilege, email volume, and business criticality so that executive assistants, finance teams, and other high-exposure groups do not disappear into averages.
- Use continuous simulations with adaptive difficulty Run regular behaviour checks that adjust difficulty by user performance and reward reporting behaviour immediately so the programme measures real-world detection rather than pattern recognition.
Bottom line: Security awareness training can produce a polished dashboard without materially lowering human risk.
Glossary terms: Exposure Metric, Behavior Change Campaign, Human Risk Concentration, Reporting Latency
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
25/10/2026 11:12 am
Activity-led awareness is a measurement trap, not a risk control. When programmes optimise for completions, quiz scores, and campaign throughput, they reward visibility rather than resilience. Human risk only falls when the control proves that employees detect and report threats in realistic conditions. The practitioner conclusion is to stop treating participation as the outcome and start treating behaviour change as the control objective.
A question worth separating out:
Q: Why does security awareness belong in identity governance?
A: Because user behaviour is part of access risk. People with valid access still create exposure when they mishandle credentials, ignore policy, or fall for social engineering. Awareness supports identity governance by reducing the likelihood that legitimate accounts become the attack path, especially during onboarding, role changes, and elevated access periods.
👉 Read our full editorial: Security awareness metrics often hide human risk reduction gaps
This post was modified 6 days ago by NHI Mgmt Group