Topic starter
11/11/2026 5:57 pm
TL;DR: Human error is implicated in roughly 90% of successful cyber-attacks, according to Panaseer, yet many organisations still measure awareness with training completions and click rates alone. That leaves culture, confidence and control coverage invisible, which weakens risk decisions.
Editorial analysis by NHI Mgmt Group, based on content published by Panaseer: “How do you measure cyber awareness culture?”.
By the numbers:
- 90% of successful cyber-attacks can be traced to human error.
Key questions
Q: Why do phishing simulations fail to show real security culture?
A: Phishing simulations fail as a culture measure because they mainly test click behaviour in a controlled exercise, not how people detect, report, and escalate suspicious activity in real work.
Q: What is the difference between security awareness and security culture?
A: Security awareness is what people know about threats, policies, and safe behaviours.
Q: How should teams measure cyber awareness culture beyond click rates?
A: Teams should combine behaviour, confidence and context rather than relying on one-off quiz scores or phishing clicks.
Practitioner guidance
- Measure confidence alongside correctness Use assessment formats that record answer confidence and response time, then compare those signals against accuracy to find overconfident users or weakly engaged groups.
- Correlate awareness with access and lifecycle events Join training records, auto-lock telemetry, HR joiner-leaver data and privileged access logs so you can see whether the right people were exposed to the right controls at the right time.
- Treat unattended sessions as a culture metric Track how often devices move from active use to auto-lock, then investigate patterns by team, location and role to separate habit failure from policy failure.
Bottom line: Cyber awareness programmes become materially more useful when they measure behaviour and confidence instead of only completions and click rates.
Glossary terms: Continuous Controls Monitoring, Phishing Simulation, Auto-Lock, Cyber Awareness Culture
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/11/2026 6:06 pm
Cyber awareness only becomes governable when it is measured as behaviour, not attendance. Completion rates and click counts are useful, but they mostly prove that a process happened. They do not prove that people understand why the process matters or that they will behave differently when pressure rises. The practical conclusion is that awareness programmes need behavioural evidence, not just audit evidence.
A question worth separating out:
Q: How do continuous control data and human risk metrics work together?
A: Continuous control data shows whether controls are working, such as MFA coverage, privileged access reviews, patch status, and logging completeness. Human risk metrics show how people behave, such as repeated policy breaches, phishing reports, or excessive access requests. Used together, they connect control effectiveness with the human behaviours that create residual risk.
👉 Read our full editorial: Cyber awareness metrics that measure behaviour, not just compliance