In short: Measuring security awareness training effectiveness means tracking behaviour, not just attendance. The most useful metrics are the report rate and time to report for phishing, the share of repeat clickers, credential submission rates, completion by team and the trend over several months, judged against how hard each simulation was.
Why completion rates are not enough
Most platforms make it easy to show a high completion percentage. It satisfies an auditor, but it says nothing about whether staff would spot a convincing fake invoice next Tuesday.
The NCSC's guidance on engagement and training makes the point directly: awareness alone is not enough, so check whether people can and do perform the behaviours you want, and allow time for campaigns to show results. The Cyber Governance Code of Practice also asks boards to use suitable metrics to confirm that training and awareness programmes work. See cyber security training for board members.
So measure three layers:
- Activity: is training being delivered and completed?
- Behaviour: do people report suspicious messages, and fast? Do they still click or enter credentials?
- Outcome: are real incidents caught earlier, and are fewer reaching the point of damage?
The metrics that matter
| Metric | What it tells you | Good direction |
|---|---|---|
| Report rate | Share of people who report a simulated (or real) phish using the report button | Up |
| Time to first report | How quickly the first person flags a campaign, which is how fast your security team could react to a real one | Down |
| Credential submission rate | Share of people who go beyond a click and enter a password or approve access | Down |
| Click rate | Share who clicked a link, opened an attachment or scanned a QR code | Down, judged against difficulty |
| Repeat clickers | People caught by consecutive simulations, who need a different kind of help | Down |
| Simulation coverage | Share of staff who received at least one simulation in the period | Close to everyone |
| Training completion by team | Where training is not reaching people, often a sign of workload or poor targeting | Up |
| Real phish reported | Genuine suspicious messages reported by staff | Up |
Report rate and time to report are the headline measures. A click by one person matters far less if ten colleagues report the message within minutes and it is pulled from every inbox. The NCSC recommends measuring reports as well as clicks, so people are rewarded for reporting. See how to report a phishing email.
Avoiding vanity metrics and misleading trends
Some numbers look good while hiding problems:
- A falling click rate from easier tests. If simulations get simpler, clicks fall without anyone learning anything. Compare like with like, or use a difficulty-adjusted view. Microsoft's Attack Simulation Training shows a predicted compromise rate, based on historical Microsoft 365 data, beside your actual rate for each simulation, which helps with exactly this
- 100% completion with no behaviour change. Completion is an input, not a result
- A single annual test. One data point cannot show a trend; run varied simulations every month or quarter
- Click rate without report rate. You learn who failed but not who protected the organisation
- Automated clicks. Link scanners in some email security tools can open simulation links and inflate clicks. Allow-list the platform properly and check click timing, device and IP details before drawing conclusions
Do not chase an external benchmark figure either. Results depend on your sector, your simulations and your staff. Your own trend over time is the fairest comparison.
Repeat clickers: handle with care
Repeat clickers are worth tracking because they show where standard training is not working. In Attack Simulation Training, for example, a repeat offender is someone compromised by consecutive simulations; the default threshold is two, and administrators can change it.
What you do with the list matters more than the list itself:
- Offer a short one-to-one conversation or a different training format, not a warning letter
- Check for causes beyond knowledge: workload, mobile-only working, a role that receives many external emails
- Add technical protection for that person's account, such as stronger MFA
- Keep the names out of board reports; report the number and the trend
The NCSC is clear that blaming people who click does not work and makes them less likely to report. See building a positive security culture.
A board reporting template
Boards need a short, consistent view every quarter, not a raw export. The Cyber Governance Code of Practice asks for formal reporting at least quarterly, with metrics and agreed tolerances. A one-page report can follow this structure:
| Section | What to include |
|---|---|
| Headline | One sentence: is people-related risk going up, down or flat, and why |
| Behaviour | Report rate, time to first report and credential submission rate, with the previous three quarters for comparison |
| Coverage | Training completion and simulation coverage by department, with gaps explained |
| Higher-risk groups | Finance, executives, IT help desk and new starters: how they compare with the organisation |
| Real incidents | Genuine phish reported by staff, and any incidents where a person was the entry point (no names) |
| Risk signals | Where available, a human risk score trend, such as the usecure uHealth score or the Hornetsecurity Employee Security Index |
| Actions | What changes next quarter: new topics, targeted training, technical fixes |
The same evidence helps with insurers and auditors; see security awareness training for cyber insurance.
What each platform reports
Most platforms we supply report completion, simulation results and trends, and many add a risk view:
- Microsoft Attack Simulation Training (included with Microsoft Defender for Office 365 Plan 2 or Microsoft 365 E5): training efficacy (predicted vs actual compromise rate), user coverage, training completion and repeat offender reports, with CSV export
- Hornetsecurity Security Awareness Service: the Employee Security Index with history and forecasts on the Awareness Dashboard
- usecure: human risk reporting, plus uHealth's organisation risk score and per-person risk ratings
- Sophos Phish Threat: a reporting dashboard with live Awareness Factor data, trends in who was caught and who reported, and testing coverage
For a side-by-side view, see security awareness training platforms compared. To move from reporting to targeting, read about human risk management.
We build and present these reports as part of our managed security awareness training. Contact us for a sample board report.
How Forever Systems runs your awareness programme
We are vendor-independent. We compare the security awareness and phishing simulation platforms that suit your size, sector, Microsoft 365 licensing and existing security tools, recommend one, then run it for you so training and phishing tests actually happen month after month.
- Baseline phishing simulation to see where you start
- Platform selection and set-up, with single sign-on and automatic user sync from Microsoft Entra ID or Google Workspace where the platform supports it
- A year-round plan of short training modules, simulated phishing campaigns and policy sign-off, including new-starter induction
- Sector and role content for schools, charities, healthcare, legal, finance, public sector and high-risk roles such as finance teams and help desks
- Reporting for the board, auditors, insurers and Cyber Essentials, showing completion, reporting and click trends
- Joined-up defences: email security, MFA, endpoint protection and dark web monitoring so training is backed by technology
Forever Systems Ltd provides IT and cyber security services to UK organisations. Pricing depends on user numbers and platform, so ask us for a quote.
Want help choosing and running security awareness training?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
How do you measure the effectiveness of security awareness training?
Track behaviour over time rather than attendance alone: phishing report rate, time to first report, credential submission rate, click rate judged against simulation difficulty, repeat clickers and coverage. Compare each quarter with the last and link the results to real reported phish and incidents.
What is a good phishing click rate?
There is no fair universal figure, because results depend on how hard the simulations are and who receives them. Focus on your own trend over time, compare like-for-like simulations, and give equal weight to how many people report the message and how quickly.
What KPIs should be in a security awareness report to the board?
A short headline on risk direction, report rate and time to report, credential submission rate, completion and simulation coverage by department, results for higher-risk groups, genuine phish reported and the actions planned for next quarter. Leave individual names out.
How often should phishing simulations be run to measure progress?
Monthly or at least quarterly, with varied techniques and difficulty. A single annual test gives one data point and cannot show whether behaviour is improving.
Why is report rate more important than click rate?
Someone will eventually click a convincing phish. What limits the damage is how many people report it and how fast, because that lets your IT or security team remove the message and act before an attacker can use stolen access.