The quarterly slide said the phishing click rate had fallen from 14 percent to 5 percent, and the executive committee moved on. Nobody mentioned that the latest simulation used a clumsy template almost anyone could spot, or that only 8 percent of employees had reported it. The number improved; the organization may not have.
Measuring an awareness program honestly is harder than running one. On the CompTIA Security+ SY0-801 exam this sits under objective 5.6, which expects you to choose the measure, the report and the follow-up that fit a situation. This lesson covers the metrics that show whether behavior is changing, how to read them across quarters, how to report them to different audiences, and how personnel behavior risk scoring combines signals to aim training, along with the privacy and fairness problems it brings.
Good metrics measure behavior, not just attendance
Awareness metrics come in three layers, and a program that reports only the first can't tell whether it works.
| Layer | What it shows | Examples |
|---|---|---|
| Activity | Training happened | Completion rate, overdue assignments |
| Behavior | What people do when tested or attacked | Click, submission and report rates; time to report |
| Outcome | Whether incidents and losses change | Incidents from human error, real phish reported, BEC payments stopped |
Completion still matters. Frameworks require training, auditors ask for completion evidence, and a department at 60 percent completion is a management problem. But 98 percent completion says nothing about whether those people would spot a phish. Behavior metrics come from simulations, the report button and security tools, and they are the core of the scorecard. Outcomes are what the business cares about, but they move slowly and depend on many controls at once, so behavior metrics give the earlier signal.
Simulation metrics are shares of messages delivered. Click rate is the share of recipients who clicked the link or opened the attachment. Submission rate is the share who entered credentials or other data, the more serious failure. Report rate is the share who reported the message, and time to report measures how quickly the first and typical reports arrived.
Report rate and time to report tell you more than click rate
Click rate is the number everyone quotes and the one most easily misread. It depends heavily on the template: an easy lure produces a low rate and a hard one a high rate, whatever the training. It can be pushed down by making simulations easier, by announcing them, or by people ignoring email altogether. And it never reaches zero, because in a large organization someone always clicks a good lure.
Report rate measures the behavior the program wants. A user who clicks and then reports within a minute has helped the security team; one who doesn't click but doesn't report has protected only themselves. Report rates tend to rise before incident numbers fall, which makes report rate the better leading indicator.
Time to report matters because of what follows. Once the first credible report arrives, analysts can find every copy, block the link and purge the inboxes. If that report comes six minutes after delivery, most recipients haven't opened the email yet. If it comes two hours later, the attacker may already have passwords. A simulation platform's summary shows the measures side by side:
campaign=2026-09-invoice delivered=2,140 difficulty=hard
clicked=263 (12.3%) submitted=81 (3.8%) reported=899 (42.0%)
first_report=+00:05:48 median_report=+00:38:20 reports_per_click=3.4
Some programs track that last ratio of reporters to clickers, which rises as the culture improves. Real phishing counts too: how many real malicious messages staff report, and what share of all reports turn out to be genuine threats.