How to Measure Human Cyber Risk: Metrics and KPIs That Matter

Hero Summary

The most useful measures of a security awareness or human risk program track behaviour and outcomes, not attendance: how many suspicious messages employees report, how quickly they report them, how often individuals and groups fail realistic simulations, whether repeat failures fall, how knowledge assessments change, and whether real incidents caused by human error decline. Click rate alone is a weak measure, because it depends heavily on how hard the simulations are. NIST's guidance on learning programs includes suggested metrics and evaluation methods and stresses regular improvement.

Executive Summary

Leaders ask whether training is working. The honest answer requires measures that connect to risk. Completion rates show that people attended; they do not show that behaviour changed. This guide sets out a practical measurement set in four groups — participation, behaviour, knowledge, and outcomes — explains how to interpret each, how to segment results by role, how to report to management, and common ways measurement goes wrong.

Why measurement matters {#why}

Without measurement, a program cannot improve or justify its budget. With the wrong measurement, it can optimize for the wrong thing — such as making simulations easy so click rates look good. The goal is to track the risk that people create and show whether it is falling.

The four groups of metrics {#groups}

Group	Examples	What it tells you
Participation	Training completion, time to complete, coverage of new joiners	Whether the program reaches people
Behaviour	Reporting rate, time to report, simulation failure rate, repeat-failure rate, data-entry rate	Whether people act safely in realistic situations
Knowledge	Baseline and follow-up assessment scores	Whether understanding improves
Outcomes	Real phishing reports that were genuine, incidents traced to human error, near-misses stopped, payment-fraud attempts caught	Whether risk is actually lower

Participation is necessary but not sufficient; the most informative groups are behaviour and outcomes.

Behaviour metrics in detail {#behaviour}

• Reporting rate. The share of simulated and real suspicious messages that employees report. A rising reporting rate is among the best signs of a healthy culture, because it means people are acting as sensors.
• Time to report. How quickly after delivery a suspicious message is reported. Faster reporting shortens the time an attacker has.
• Simulation failure rate. The share who click or open. Interpret it alongside the difficulty of the simulation: easier templates produce lower rates without any change in real-world resilience.
• Data-entry or action rate. Among those who click, how many go on to enter credentials or take the requested action — a stronger signal of real risk than a click alone.
• Repeat-failure rate. How many people fail more than once. A small group often accounts for a large share of failures; these people need targeted support, not blame.
• Channel coverage. Results for email, SMS, and voice simulations separately, since people may be stronger in one channel than another.
• Behavioural indicators beyond simulations, such as adoption of multi-factor authentication or use of approved password tools, where the organization can observe them responsibly.

Segmenting by role and department {#segment}

An organization-wide average hides where risk concentrates. Break results down by:

• Role — finance, HR, executives and assistants, IT administrators, developers, customer support.
• Department and location.
• Access level — people with access to payments, sensitive data, or administrative systems.
• Tenure — new joiners often need extra support.

This shows where to focus training and where non-training controls are needed. See Role-Based Security Awareness Training.

Reporting to management and the board {#reporting}

Executives want few, stable numbers and a trend. A useful summary includes:

• an overall readiness or risk score and its trend,
• the reporting rate and time to report,
• the highest-risk groups and what is being done for them,
• repeat-failure trends,
• any real incidents with a human-factor cause and what changed afterwards, and
• planned actions for the next quarter.

Present results as risk reduction and decisions needed, not as lists of training modules completed.

Pitfalls {#pitfalls}

• Click rate as the only measure. It depends on simulation difficulty and timing.
• Changing simulation difficulty without noting it, which breaks trend comparisons.
• Using metrics to punish individuals, which reduces reporting and hides risk.
• Measuring only email, when text and voice attacks are growing.
• Comparing to external "benchmarks" without knowing how they were produced.
• Ignoring outcomes. If real incidents do not fall, the program needs rethinking even if simulation numbers look good.
• Short-term snapshots. Behaviour shifts over months; measure over quarters.

A starter dashboard {#dashboard}

1. Overall readiness or risk score and trend.
2. Reporting rate and median time to report.
3. Simulation failure and data-entry rates, by channel and role.
4. Repeat-failure share.
5. Assessment score change since baseline.
6. Training completion and overdue count.
7. Real incidents linked to human factors, and near-misses.

NIST SP 800-50 Rev. 1 includes suggested metrics and evaluation methods and emphasises regular assessment and improvement of the program, which fits this approach.

How Threat ResQ's TRISA fits {#trisa}

TRISA is Threat ResQ's AI security awareness and human risk intelligence platform. It begins with a baseline Cyber Knowledge Quotient (CKQ) assessment per employee, adapts each person's learning path, and provides continuous readiness scoring — fed by TRAP's phishing, smishing, and vishing simulation — with department-level and board-level reporting. See What Is Human Risk Management? and Phishing Simulation Best Practices.

FAQ {#faq}

What metrics should a security awareness program track? Participation, behaviour (reporting rate, time to report, simulation failure and repeat-failure rates), knowledge (assessment scores), and outcomes (real incidents linked to human error and near-misses stopped).

Is phishing click rate a good measure? Not on its own. It depends on how difficult the simulations are, so it should be read alongside reporting rate, data-entry rate, and trends using consistent methodology.

Why is reporting rate important? A high and rising reporting rate shows that people act as sensors, and quick reports let the security team contain a real attack early.

How often should human risk be measured? Continuously collect data, review monthly, and report trends quarterly, because behaviour changes slowly and one-off snapshots mislead.

How do I show the value of awareness training to leadership? Report risk trends and outcomes — falling repeat failures, faster reporting, fewer incidents with human-factor causes — rather than completion counts.