Every security training platform produces a completion rate. Boards and executives ask for it, compliance frameworks reference it, and audit reports lead with it. The problem is that completion rate measures attendance, not behaviour change. An employee can watch a phishing awareness video, click confirm on the quiz, and open a credential-harvesting email the same afternoon. If you are only tracking completion, you are measuring the least predictive indicator of security posture. The CISOs who build genuinely resilient organisations measure different things.
Phishing simulation click rate over time. A single phishing simulation gives you a baseline. Four simulations over a year, using progressively more sophisticated scenarios, give you a trend. If click rates are falling across the organisation - and particularly in departments that started high - your training is working. If they are flat or rising, you have a content or culture problem. The metric to watch is not the absolute click rate but the direction of change. High-performing security programs typically see click rates drop by 40 to 60 percent over 12 months of consistent simulation and training. Track click rate by department so you can identify where the program is landing and where it is not.
Threat reporting rate. The inverse of the click rate, and arguably more important
what percentage of simulated phishing emails are being reported to the security team rather than clicked, ignored, or deleted? A high reporting rate means employees are engaged, that they trust the reporting process, and that they have the skills to recognise suspicious communications. Organisations with strong reporting cultures catch real threats faster - often within minutes of delivery - because employees who have been trained to report simulations apply the same habit when a real attack arrives. Track this metric monthly and celebrate improvements publicly.
Repeat offender rate. Some employees click every simulation regardless of how many training modules they complete. This is valuable data. It tells you that completion-based remediation - assign another module - is not working for this individual. Repeat offenders benefit from a different approach: one-on-one coaching, a conversation with their manager, or a change in their access level while additional training is underway. A security program that treats all employees identically will plateau. The repeat offender rate surfaces the individuals who need a different intervention.
Post-training behaviour change in high-risk processes. For finance and HR teams, track whether verification workflows for payment changes and sensitive data requests are being followed. The best proxy is exception reporting: how often are payment change requests processed without the two-step verification your policy requires? If exceptions are frequent, the training is not translating into process compliance. This requires coordination between the security team and operations, but it is the most direct evidence that training is affecting actual behaviour in the highest-risk workflows.
Incident response time. When an employee suspects a security incident - a suspicious email, an unusual login, a missing device - how long does it take them to report it? Track the average time between an event occurring and the security team being notified. Organisations with strong awareness training see this number fall over time because employees know who to call, feel confident doing so, and do not wait to see whether the problem resolves itself. A slow reporting time is often a culture indicator: employees are uncertain whether reporting will get them in trouble, or they do not know the process. Both are fixable with training.
Policy adherence indicators. Security policy covers everything from approved software lists to data retention requirements to device management. Track the rate at which employees are using unapproved tools, storing data outside authorised systems, or failing device management enrollment. These indicators tell you whether training is connected to operational reality. If your acceptable use policy prohibits storing company data on personal cloud drives but your data loss prevention tools show frequent uploads to personal accounts, the training message is not reaching its intended audience - or it is reaching them but not changing behaviour. Adherence metrics expose that gap.
Business language reporting. Boards and executive teams make better security investment decisions when metrics are presented in terms they use: risk reduction, loss avoidance, operational continuity. A CISO who reports that phishing click rates fell from 34 percent to 11 percent over the year, that the organisation avoided two high-probability BEC incidents based on employee reporting, and that incident response time dropped from 48 hours to 6 hours is making a compelling business case. The same data presented as module completion percentages is less persuasive. Translate your security metrics into business outcomes and you will find it easier to secure the budget, headcount, and leadership support your program needs to keep improving.
Completion rate is a participation metric. Boards care more about whether risky behavior is actually going down.
