Security Awareness Metrics: Who Clicked Is the Least Interesting Question
Cyber Security Awareness Month is over. Security culture isn't one month, it's twelve. Here's what to measure in the other eleven.
Most security awareness metrics come down to two numbers: the click rate and training completion. When October's awareness month was written up, most reports led with both. Clicks went down, completion went up.
Both numbers are worth having. Neither tells you whether anyone behaves differently, and neither tells you how to improve security culture. Most people are confident they can spot a phish. Far fewer actually stop, check and report one. Click and completion rates measure the confidence, not the doing.
To measure security culture, you have to stop counting events and start following people, across phishing and training together, and over time. That's what we've rebuilt Culture360° reporting to do.
The figures below are illustrative examples from Culture360°. Each one comes from the screenshot beside it; they aren’t a specific client’s results.
Security awareness metrics that follow people, not events
A funnel shows how many people dropped out at each stage. It doesn't show where they went. So Culture360° now reports phishing as a flow: every person targeted, followed from delivery to what they did first, what they did next, and whether anyone heard about it.
Here is what that looks like for 2,454 people targeted:
1,946 (79%) reported a simulation, 1,177 of them without clicking it first.
264 (11%) showed no engagement at all: no open, no click, no report.
82 people clicked and told nobody.
A click-rate report would say 35% clicked. It wouldn't say that 769 of those people reported it afterwards, or that 82 kept quiet. The two groups that matter most sit either side of the click.
Phishing non-responders: the people who did nothing at all
Phishing non-responders are usually counted as safe. They didn't click, so they passed. That's a mistake. Someone who shows no sign of having received the email isn't resilient; they're invisible. You don't know whether they'd click a real one, because you don't know whether it reached them.
This isn't a one-off. In this example, around one in eight people sent a simulation recorded nothing each quarter: 12% in Q1 and Q2 2026, 13% in Q3. And 188 people recorded nothing in both Q3 and Q4 to date.
So the first question about non-responders is a delivery question, not an awareness one:
Is the simulation reaching them at all, or is a filter, rule or allowlist gap quietly stopping it?
Are some of them shared mailboxes, leavers or service accounts that shouldn't be in scope?
Are they people who rarely work in email, such as field or frontline staff?
Only once delivery is proven does it become an attention question. Then the response is about channel and relevance: reach people where they work, through Teams or the intranet, with scenarios that look like their job rather than someone else's.
Clicked and told nobody
This is the group to chase first. A click you hear about within a minute is a password reset. A click nobody mentions is the start of an incident you find weeks later.
It shows up most clearly with credential entry. In this example, 224 of 515 credential submissions (43%) were followed by a report from the same person. The median time from handing over credentials to reporting it was 12 minutes, and the fastest was 21 seconds. The other 291 went unreported. Those are the chase list, and a far better use of time than the overall click rate.
Clicks tell the same story: 622 of 1,344 clicks (46%) were followed by a report, and 722 weren't.
People stay silent for predictable reasons. They're embarrassed. They don't know how to report. They assume IT will see it anyway. Or they worry they'll be in trouble. Every one of those is fixable:
One reporting route, two clicks away, the same in every channel.
Say plainly, and often, that nobody is in trouble for reporting, including after a click.
Thank the people who report, quickly and visibly, test or not.
Measure "clicked, then reported" as a success in its own right.
The first hour after a click matters far more than blame.
Employees who click after training
Completion proves attendance. It doesn't prove behaviour. Put training and phishing data side by side and everyone falls into one of four groups:
Clean on both (711): training up to date, and no clicks.
Clicked only (394): training up to date, and still clicking.
Overdue only (51): behind on training, but has never clicked a phish.
Failing both (21): clicked and overdue.
The uncomfortable group is the second: employees who click after training. Here it's a third of everyone shown. Either the training isn't landing for them, or the lure looks too much like their real work.
Sending them back through the same course rarely helps. What does:
Short, targeted training triggered by the behaviour itself, the day it happens, not at the next annual cycle.
Refresher tests that check the habit months later, rather than repeating the module.
A conversation, not a sanction. Time pressure and workflow explain more repeat clicks than ignorance does.
The fourth group, failing both, is small in most organisations and should get a direct conversation with their line manager.
Not failing, just drifting
Some of the most useful signals aren't failures at all. Training finished late. Refresher tests ignored. Never once reported a simulation. Each one on its own is minor. Together, in the same person, they're a pattern.
"Completed" hides a lot. A programme can report high completion while many people finish well after the deadline. Completion and timeliness are different measures, and only one of them is usually reported.
A missing refresher isn't always the person's fault, either. We've seen refresher tests that the platform simply never sent. Nobody can be non-compliant with a test they never received, so we report that as a delivery problem, not a breach. Get that wrong and you chase the wrong people.
Drifters respond to light, early pressure: a nudge timed to the deadline, a line manager copied in at a set point, and recognition for the people who are consistently current.
Measuring security culture over time: is anyone actually changing?
A single month tells you where people are. It doesn't tell you whether they're moving. That's the question an awareness month can't answer, and the next eleven can.
So Culture360° follows the same people from one quarter to the next. Everyone who was sent simulations in both quarters gets one outcome per quarter: reported, clicked then reported, opened only, no engagement, or clicked and told nobody. A flow shows how they moved between them, summed up in four counts:
Improved: told nobody last quarter, reported this one.
Slipped back: reported last quarter, clicked and told nobody this one.
Went quiet: reported last quarter, nothing recorded this one.
Still silent: told nobody in both.
In this example, 2,827 people were sent simulations in both Q2 and Q3 2026. 70 improved, 50 slipped back, 22 went quiet and 10 stayed silent in both quarters. The report rate per email rose from 18% to 21%.
People who showed no engagement in either quarter are persistent non-responders. They need re-engagement, not more training.
This is individual behaviour change, not a headline rate drifting up or down. You can compare against the previous quarter, or against the same quarter last year to take out seasonality.
Two things stop the trend misleading you. First, each simulation counts in the period it was sent, so a report that arrives a week later still counts towards the campaign that prompted it. Second, exposure is checked. If people received far fewer simulations in one period than another (more than 25% different, by default), the dashboard says the two aren't like for like. Otherwise a quiet quarter looks like improvement and a busy one looks like decline. In this example, exposure was the same in both quarters, at 3.0 simulations per person, so the rise in reporting is real.
Each month is also saved as a snapshot of counts, never names, along with the settings and campaigns used. This month measures the same thing as last month, anything new is flagged rather than slipped in, and the trend survives even if the platform's own log doesn't go back far enough.
Two scores, two different questions
Boards want one number from their security awareness metrics. But one number can't answer two different questions: how much risk does our people's behaviour carry, and how many of our people are doing the basics? So Culture360° has two scores, built for each.
The culture score: the diagnostic
The culture score is a single 0 to 100 risk index for the whole organisation, where lower is better. It's built as risk minus mitigation.
Risky behaviours add to it, weighted by how serious they are. Entering details on a simulation counts most, followed by overdue training, clicks, breached refresher deadlines and ignored refreshers. Protective behaviours take points off: reporting simulations, reporting after a click, finishing training on time, nudges that led to completion, and reporting speed.
The mitigation is capped, so good behaviour can bring the score down but can never cancel out people handing over their details. It never scores an individual. A measure with no data is skipped, not scored as zero. Months with very few sends are smoothed so they can't produce a spike. And because the weights and targets are saved with each month's history, it's measured the same way every month, quarter and year.
In this example the culture score is 65, rated high: 80 points of risk, less 15 points of mitigation. Credential submission is at 12.8% against a 2% target and link clicks at 34.7% against 10%, so both max out. Reporting is strong at 79%, but it only earns back 5.4 points. Good reporting can't hide that one person in eight handed over their details.
This is the score for the security team: how much risk the population carries, and which behaviour is causing it.
The cyber resilience score: the standard
Boards are often told the organisation is compliant, or green on a RAG, because training completion is over target. People who aren’t due, or have never been assessed, can’t fail that measure. The rating sits at green while behaviour goes unmeasured.
The optional cyber resilience score, currently in beta, replaces that with a standard. Each person is measured against four tests, each simply met or not met:
Training complete: no assigned training overdue.
Refreshers answered: the latest refresher has been completed, once its answer window has passed.
No click left unreported: any click, or details entered, was reported. Owning a mistake counts.
Reports simulations: reports at least a set share of the simulations received, a quarter by default.
A person's score is the share of their standards they meet. The organisation's human risk score is the average across everyone measured, rated green from 85% and amber from 75% by default. The clearest Board headline is usually how people fall: meeting all four, missing one, or missing two or more. It also shows which standard is holding the score back, and which departments the gaps cluster in.
In this example, 464 of 500 people were measured; the other 36 had joined less than three months earlier. The human risk score is 75.9%, amber. 185 people (40%) meet all four standards, 160 (34%) miss one and 119 (26%) miss two or more. By standard: training complete 84.5%, refreshers answered 87.5%, no click unreported 74.8%, reports simulations 59.9%. The organisation is mostly trained. What holds it back is reporting.
It's built to be fair. New starters are only measured after three months. Admin accounts, long-term absence and duplicates are excluded, each listed with a reason. Phishing is judged over a fixed 12 months with a minimum number of simulations, so the result doesn't depend on which period you're viewing. A standard with no evidence yet is left out, not failed.
Scoring individuals is profiling under data protection law, and we treat it that way. The score is off by default, switched on only once the organisation has confirmed how it will be used, and it's for awareness and support, not discipline.
This is the score for the Board, and the kind of measure our CISO as a Service clients take into the boardroom: a KPI with a target, which moves when behaviour changes, not when a module is ticked off.
Why the two scores move apart
A spike in credential submissions drives the culture score up while barely touching the resilience score. A large group just missing the reporting bar drops the resilience score while the culture score hardly moves.
Read together, they tell you whether the problem is severity or breadth, and those need different actions:
Severity, a few serious failures: targeted follow-up and line manager escalation.
Breadth, many people short on the basics: organisation-wide awareness and an easier way to report.
How to improve security culture in the other eleven months
October got the attention. Attackers don't take the rest of the year off. Good security awareness metrics tell you what to do next, so read the trend, then act on it:
Silent clickers rising: make reporting easy and blame-free, follow up with the individuals, and bring in line managers for repeats.
People slipping back: a refresher or nudge now, before the old habit sets.
People going quiet, or never responding: check they're actually receiving simulations, then re-engage them. More training won't reach someone who isn't there.
Report rate flat while clicks fall: change the message from "don't click" to "tell us".
One team or lure type stands out: tailor content and simulations to that team or tactic.
A quarter with few simulations: fix the cadence before you draw conclusions.
One standard holding the resilience score back: put the effort there, whether that's training, refreshers, clicking or reporting.
Thank your reporters. It's the cheapest intervention you have, and the one that changes behaviour fastest.
Frequently asked questions
What are the best security awareness metrics?
The ones that show behaviour, tracked per person over time: report rate, clicked then reported, clicked and told nobody, credential entry, and no engagement, alongside training timeliness and refreshers. Click and completion rates are context, not outcomes.
How do organisations measure and improve security culture?
Follow the same people across phishing and training over time, measure them against a clear standard, and act on the groups that show up: silent clickers, people who click after training, drifters and non-responders.
What is a phishing non-responder?
Someone sent a simulation who records no open, click or report. Check the simulation is reaching them before treating it as an awareness problem.
Why do employees click after training?
Usually because the training didn't land for them, or the lure looked like their real work. Short training triggered by the behaviour itself works better than repeating the course.
See it in practice
Read our security culture case study, or see how Culture360° runs training, phishing simulation and reporting as one managed service. Our free security and privacy assessments give you a scored baseline in minutes. To turn the numbers into a Board conversation, talk to us.
Awareness month is where you get people's attention. The eleven months after it are where you improve security culture. The measure isn't whether someone clicks. It's whether they speak up when they do.
Comments