Why Your Human Risk Dashboard Isn’t Helping You

Table of Contents

• What Does a Typical Human Risk Dashboard Measure?
• Why Activity Metrics Only Tell Part of the Story
• The Problem with Relying on Phishing Click Rates
• What CISOs Actually Need from Human Risk Reporting
• Moving From Activity to Risk Reduction
• Rethink How You Measure Human Cyber Risk

Security teams have more data at their fingertips than ever. Training completion rates, phishing simulation results, reporting rates, policy interactions and a growing list of other metrics can all be pulled into dashboards and presented back to the business. 

The problem is that having more data doesn’t necessarily mean having a clearer picture of human cyber risk. 

Our Rethinking Human Cyber Risk research found that 74% of CISOs say their current human cyber risk reporting produces dashboards, but not enough of a clear understanding to make better decisions. Even more tellingly, 89% can’t confidently link security awareness activity to reductions in incidents or near misses. 

That creates a difficult situation for security leaders. They’re collecting data and reporting on their awareness programmes, while facing growing pressure to demonstrate that those programmes are reducing risk. 

So, what’s missing? 

What Does a Typical Human Risk Dashboard Measure?

Most security awareness dashboards are good at showing activity. They can tell you how many employees completed a training course, who opened a simulated phishing email, who clicked a link, how many suspicious emails were reported or whether a particular campaign reached its intended audience. 

Each of these metrics has a purpose. Completion rates can help demonstrate compliance, while phishing simulation data can highlight behaviours that may warrant further attention. The problem comes when activity becomes the main way success is judged. 

According to our research, 70% of CISOs say their current security awareness reporting relies on activity metrics such as training completions or phishing click rates. These figures are easy to capture, easy to put into a dashboard and easy to report to senior stakeholders. 

What they’re less good at answering is the question CISOs increasingly need to answer: is human cyber risk going down? 

Why Activity Metrics Only Tell Part of the Story

Imagine 98% of employees complete their annual cyber security training. On paper, that looks excellent, but what does it tell you about how those employees will respond when a convincing phishing email lands in their inbox three months later? Do they recognise the warning signs? Do they know what to do? Are some teams, roles or locations consistently demonstrating riskier behaviour than others? 

A completion rate alone can’t tell you. The same problem applies across many of the metrics security teams have traditionally relied on. They confirm that an activity happened, but often provide little insight into whether behaviour changed as a result. 

CISOs are under increasing pressure to prove value, with 77% of the CISOs we surveyed saying they’re expected to prove ROI more rigorously for human cyber risk initiatives than for technical controls. 

If the data available to them primarily measures activity, demonstrating that return becomes much harder. Security leaders can show that employees were trained or simulations were delivered, but making a credible connection between that activity and meaningful risk reduction is another matter entirely. 

The Problem with Relying on Phishing Click Rates

Phishing simulation click rates are one of the most familiar measures of security awareness performance, and they can be useful. A high click rate can indicate an area that deserves attention, while changes over time can provide another signal of employee behaviour. 

But a click rate shouldn’t be expected to explain human cyber risk on its own. Someone clicking one simulated phishing email doesn’t necessarily make them a permanently high-risk employee. Equally, somebody who doesn’t click a simulation isn’t automatically low risk. 

Context is important here. What type of phishing attack was used? Was it relevant to that employee’s role? How difficult was it to spot? Has the employee demonstrated similar behaviour before? Did they report the email afterwards? What happened following the simulation, and did their behaviour improve the next time they encountered a similar threat? 

Looking at an isolated percentage can strip away much of that context. Human behaviour changes over time and varies according to role, situation and the threats employees encounter. Measuring it effectively therefore requires more than a collection of individual activity metrics. 

What CISOs Need from Human Risk Reporting

A useful human risk dashboard should help security teams decide what to do next. That means moving beyond questions like “How many people completed the training?” and towards questions that reveal how risk is changing across the organisation. 

Where is human cyber risk concentrated? Which groups are demonstrating behaviours that could increase exposure? Are those behaviours improving following an intervention? Which types of training or phishing simulations appear to work for particular groups? Where should the security team focus its attention next? 

These are much more useful questions because they connect measurement with action. Yet our research shows how difficult that remains for many organisations. 76% of CISOs say different stakeholders expect different human cyber risk metrics, while CISOs across all four countries we surveyed reported challenges establishing consistent measurement across roles, regions and business units. 

Without a shared view of what meaningful progress looks like, dashboards can quickly become collections of numbers designed to satisfy different reporting requirements rather than tools that support better security decisions. 

Moving From Activity to Risk Reduction

To better measure human cyber risk, you don’t necessarily need to stop looking at the metrics you already have. Completion rates, phishing simulation results and reporting behaviour can all contribute useful information. The opportunity is to bring those signals together and use them to build a clearer picture of how human cyber risk is changing. 

Instead of looking at whether someone completed training in isolation, for example, organisations can examine whether subsequent behaviour changed. Instead of treating a phishing click as the end of the story, they can use it as a signal that helps determine whether an employee or group would benefit from a relevant intervention. 

Over time, this creates a much richer view of risk. It can help security teams identify patterns across groups, understand where additional support is needed and see whether interventions are having the intended effect. It also gives CISOs something far more meaningful to take into conversations with the board. 

That’s particularly important when currently only 39% of CISOs feel completely confident explaining the value of security awareness initiatives to their board or C-suite. 

A dashboard that says 97% of employees completed training tells the board that an activity happened. A behaviour management approach that can demonstrate where risk is concentrated, what action has been taken and whether behaviour is improving gives them something much more useful. 

Rethink How You Measure Human Cyber Risk

Better human risk measurement comes from connecting the signals you already have and using them to understand where risk is changing and where action is needed. 

MetaCompliance helps organisations do exactly that. Our human risk management platform brings together data from security awareness training, phishing simulations and employee behaviour to give security teams greater visibility into risk across their workforce. 

Those insights can then be used to prioritise higher-risk groups, deliver more relevant interventions and track whether behaviour improves over time. Security teams get a clearer picture of where attention is needed, while CISOs have more meaningful evidence to support decisions and conversations with the board. 

The aim is to make measurement useful: helping you understand where risk sits, how it’s changing and what to do next, rather than simply reporting on the activity that’s already happened. 

Download the full Rethinking Human Cyber Risk report to discover what 200 CISOs across France, Germany, Sweden and the UK told us about the measurement challenge, and the practical changes security leaders believe can help move human risk management forward.