Topic starter
11/11/2026 5:56 pm
TL;DR: The problem with human cyber risk reporting is that activity metrics can look healthy while behaviour stays unchanged, according to MetaCompliance. CISOs need dashboards that show whether exposure is actually falling, not just whether training and simulations were completed.
Editorial analysis by NHI Mgmt Group, based on content published by MetaCompliance: “Why Your Human Risk Dashboard Isn’t Helping You”.
By the numbers:
- 74% of CISOs say their current human cyber risk reporting produces dashboards, but not enough of a clear understanding to make better decisions.
- 89% can’t confidently link security awareness activity to reductions in incidents or near misses.
- 70% of CISOs say their current security awareness reporting relies on activity metrics such as training completions or phishing click rates.
Key questions
Q: Why do click rates give a misleading picture of phishing risk?
A: Click rates compress very different outcomes into one number, so they hide privilege, context, and whether the user reported the message.
Q: How should security teams report awareness outcomes to the board?
A: Report awareness outcomes in terms the board can govern: completion rates, phishing susceptibility, reporting rates, repeat-failure trends, and how interventions changed behaviour.
Q: How do I measure human cyber risk beyond training completions?
A: Use a mix of behavioural and activity signals, then look for change over time rather than a single score.
Practitioner guidance
- Build a behaviour-linked dashboard Combine training completion, simulation behaviour, reporting rates and follow-up outcomes so the dashboard shows whether risk is moving, not just whether activity occurred.
- Segment reporting by risk group Break metrics out by role, business unit, geography and prior behaviour so repeated patterns are visible and interventions can be targeted where exposure concentrates.
- Track post-intervention change Measure whether a group’s behaviour improves after training or a simulation campaign, then compare that trend with its previous baseline before treating the intervention as effective.
Bottom line: Human cyber risk dashboards lose value when they optimise for visible activity instead of showing whether behaviour changed.
Glossary terms: Human Risk Dashboard, Phishing Simulation, Behavior Change, Security Awareness Reporting
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/11/2026 6:07 pm
Human risk measurement fails when programmes mistake observability for control: dashboards can be full of activity data and still provide no decision-grade view of exposure. The problem is not that the signals are useless, but that they are often interpreted as evidence of reduced risk when they are really evidence of completed tasks. Mature reporting has to separate participation from behaviour change, otherwise the dashboard becomes a compliance artefact rather than a security instrument.
A question worth separating out:
Q: What is the difference between activity metrics and behaviour metrics?
A: Activity metrics count what people did, such as training attendance, email opens, or click rates. Behaviour metrics show whether that activity changed real security behaviour, for example fewer phishing clicks, faster reporting, stronger MFA use, or reduced policy violations. Activity measures volume, while behaviour measures the security outcome.
👉 Read our full editorial: Human risk dashboards fail when activity replaces behaviour change