How do I measure human cyber risk beyond training completions?

What to measure instead of completion rates

Completion data is a participation metric, not a behaviour metric. If you want to understand human cyber risk, measure what people actually do when they encounter suspicious content, policy friction, or a real decision point. The most useful signals are reporting behaviour, simulation outcomes, response to interventions, and whether those measures improve or deteriorate over time.

That means combining leading indicators and outcome indicators. A reporting rate can show whether people escalate suspicious messages, while simulation results can show susceptibility and follow-through. Pair those with time-to-report, repeat clickers, refusal to use unsafe workarounds, and changes by team or role so you can see where exposure is concentrating rather than assuming training attendance reduced risk.

Use Security Culture Measurement Guide when you need a practical model for using reporting rate, time-to-report and survey data together instead of relying on one number.

How to build a usable human risk signal

Start with a small set of signals that reflect behaviour, not awareness alone. Good candidates include phishing reporting rate, click or submission rate in simulations, time to report, completion of just-in-time nudges, and whether users who were exposed to an intervention changed their later behaviour. The point is to detect movement in risk, not to declare a person safe or unsafe from a single event.

Normalise those signals by group and context. A team that handles more external email or customer contact will often generate different patterns from a back-office team, so compare like with like. Track trends at the team, role, or business-unit level, because group-level patterns are usually more actionable than a single individual score.

Use Human Risk Management Programme Guide for the telemetry and intervention model that supports behaviour-based measurement beyond annual awareness cycles.

For a broader programme baseline, Security Awareness and Human Risk Management Guide covers behaviour change, metrics and culture in one operating model.

How to interpret trends without overreading the data

Look for directional change, persistence and concentration. One bad simulation result does not tell you much, but repeated failures after a targeted intervention can show that the control is not sticking. Likewise, a strong reporting rate with a slow time to report may mean people are willing to help but still need better recognition and triage habits.

Be careful with averages. A programme can look healthy overall while a few high-risk groups remain unchanged, or while repeat offenders account for a disproportionate share of exposure. That is why the most useful view is usually a trend line plus segmentation, not a single enterprise score.

Use Security Culture Measurement Guide again when you need to distinguish a true behavioural shift from a temporary metric fluctuation.

Risk and Threat Considerations

Human-risk measurement fails when organisations optimise for easy-to-collect metrics instead of exposure-reducing behaviour. Completion rates can create false confidence, while weak reporting habits, repeated simulation failures, and poor response to nudges leave the real attack surface unchanged.

Failure mechanism: The metric tracks attendance or awareness but not action, so teams miss persistent susceptibility, slow escalation, and concentrated exposure in specific roles or groups.

Impact: Leadership may underinvest in targeted controls, miss repeat patterns, and overestimate the protective value of awareness activity.

Practitioner Guidance

What to prioritise: Measure the behaviours that change attacker success or defender detection first, especially reporting, response time and repeat failure patterns. If a metric does not help you change a control, an intervention, or a target group, it is probably reporting vanity rather than risk.

What to verify: Check that the data source captures behaviour at the point of decision, not just training attendance. A good dashboard should let you answer whether risk is falling, where it is falling, and whether an intervention changed anything after the fact.

Practitioner takeaway: The best human-risk programmes treat measurement as a feedback loop for behaviour change, not as a compliance record of who completed training.

Related resources from NHI Mgmt Group

• How should security teams measure human risk programmes beyond training completion?
• How should organisations govern human cyber risk beyond awareness training?
• How should schools and universities reduce cyber risk beyond awareness training?
• Why do completion metrics fail as a measure of human cyber risk?