Most security leaders have sat through that budget conversation — the one where a CFO leans back in their chair and asks, point-blank: what are we actually getting out of all this training spend? It is a fair question. And for too long, the honest answer from our side of the table has been unsatisfying.
Completion rates and quiz scores feel like progress, but they are not ROI. They tell you that employees sat through content. They do not tell you whether anyone changed how they behave when a suspicious email lands in their inbox at 4:45 on a Friday. If we want to make the case for continued investment — and for better, more targeted programmes — we need to get serious about the right metrics.
Start With What You Can Actually Measure
The first thing to acknowledge is that perfect measurement is not the goal. Security events are rare by design — if your programme is working, breaches should not be happening at a rate that gives you clean statistical data. So instead of chasing incident counts, shift your focus to leading indicators: the behaviours that tend to precede incidents when they go wrong, and improve when training is working.
Here are the metrics that consistently prove meaningful in real-world security programmes:
-
Phishing simulation click rates over time — not as a gotcha, but as a baseline and trajectory indicator
-
Credential submission rates from simulated attacks (this is the number that actually correlates with breach risk)
-
Reporting rates — how often employees flag suspicious activity to the security team
-
Time-to-report — how quickly suspicious emails or behaviour get escalated
-
Repeat offender rates across simulation campaigns
-
Departmental and role-based performance breakdowns
The last two deserve particular attention. If the same employees keep clicking on phishing simulations across multiple campaigns, that is a signal that the training content or delivery method is not reaching them, not that they are hopeless. Role-based breakdowns, meanwhile, let you identify where your highest-risk pockets actually are, which is usually more actionable than company-wide averages.
Connecting Training Data to Business Risk
Metrics only become ROI when you connect them to business outcomes. The bridge most organisations are missing is a translation layer between security behaviour data and financial risk exposure.
One approach that has gained traction is using industry benchmark data on breach costs alongside your own simulation and incident data to model risk reduction. The Ponemon Institute and IBM publish annual cost-of-a-data-breach reports with enough granularity that you can build a rough but defensible model. If your credential submission rate drops from 14% to 4% over a year, and credential theft accounts for a known percentage of breaches in your sector at an average cost of X, you can start to frame what that shift is worth.
This is not accounting — do not present it as accounting. But it gives leadership a frame of reference that completion rates never will.
The Metrics That Sound Good But Rarely Help
It is worth being honest about what does not work, too. Training completion rates are the most over-reported metric in security awareness and among the least useful. An employee can complete every module, pass every assessment, and still wire money to a fraudster because the training never addressed the specific pressure and context they faced in that moment.
Similarly, knowledge retention scores from post-training quizzes measure memory under low-pressure conditions. What you actually want to measure is behaviour under realistic conditions, which is why simulation-based approaches consistently outperform passive content for generating usable data.
Self-reported confidence is another one to treat carefully. Research consistently shows that people who are most confident about their ability to spot phishing emails are not necessarily the ones who perform best on simulations. Confidence and competence diverge significantly in this area.
Building a Measurement Cadence
ROI measurement is not a quarterly activity — it is an ongoing programme management discipline. The organisations that do this well tend to establish a regular rhythm: monthly simulation campaigns with immediate feedback loops, quarterly behavioural trend reviews at department level, and annual programme assessments that include incident data and risk modelling.
The cadence matters because security behaviour is not static. Threat actor tactics evolve. Staff turnover changes your risk profile. A new wave of employees who missed your last onboarding cycle may have never seen a realistic phishing simulation. Without consistent measurement, you are flying blind into those changes.
The goal, ultimately, is to shift the conversation in that budget meeting. Not away from scrutiny — that scrutiny is healthy — but toward a more honest and specific one. Training that can demonstrate reduced credential submission rates, faster reporting times, and a measurable shift in high-risk department behaviour is training that earns its place in the security stack.
FAQ
Why is measuring ROI on cybersecurity training so difficult?
Cybersecurity incidents are relatively rare, making it difficult to directly connect training efforts to prevented breaches. Instead of focusing solely on incidents, organizations should measure behavioral indicators that demonstrate whether training is changing employee behavior and reducing risk.
Why aren't completion rates and quiz scores enough?
Completion rates and quiz scores only show that employees completed training content. They do not demonstrate whether employees can recognize threats, make better decisions, or respond appropriately in real-world situations.
What metrics actually matter when measuring cybersecurity training effectiveness?
The article highlights several key metrics:
- Phishing simulation click rates
- Credential submission rates
- Reporting rates
- Time-to-report
- Repeat offender rates
- Department and role-based performance metrics
These indicators provide a more accurate picture of behavioral change and risk reduction.
Why are credential submission rates so important?
Credential submission rates during phishing simulations are one of the strongest indicators of breach risk because credential theft is a common attack vector in real-world security incidents.
What is time-to-report and why does it matter?
Time-to-report measures how quickly employees report suspicious emails or behavior to the security team. Faster reporting can help organizations detect and contain threats before they cause significant damage.
Why should organizations track repeat offenders?
Employees who repeatedly fail simulations may indicate gaps in training effectiveness, delivery methods, or content relevance. Tracking repeat offenders helps organizations provide more targeted support and remediation.
How do role-based metrics improve training programs?
Departmental and role-based performance data helps organizations identify high-risk groups and tailor training to the specific threats faced by different teams, making training more effective and relevant.
How can organizations connect training metrics to business risk?
Organizations can combine their training data with industry breach cost benchmarks and incident data to estimate potential risk reduction. This approach helps translate behavioral improvements into business-relevant outcomes.
What training metrics sound useful but often provide little value?
The article cautions against relying heavily on:
- Training completion rates
- Post-training quiz scores
- Self-reported confidence levels
These metrics often fail to reflect how employees behave during realistic security situations.
Why are simulation-based metrics more valuable?
Simulation-based exercises measure actual behavior under realistic conditions rather than testing knowledge recall. This provides stronger evidence that employees can apply security concepts when it matters most.
How often should organizations measure training effectiveness?
The article recommends a structured measurement cadence that includes:
- Monthly simulation campaigns
- Quarterly behavioral reviews
- Annual program assessments
This ongoing approach helps organizations track trends and continuously improve training effectiveness.
Why is a measurement cadence important?
Employee behavior, threat actor tactics, and organizational risk profiles constantly change. Without regular measurement, organizations may miss emerging weaknesses and lose visibility into training effectiveness.
What does a successful cybersecurity training program look like?
A successful program demonstrates measurable improvements in:
- Credential submission rates
- Reporting behavior
- Reporting speed
- Department-level risk indicators
- Overall security behavior
These outcomes provide stronger evidence of ROI than traditional compliance metrics.
What is the key takeaway for security leaders?
The goal of cybersecurity training is not simply to complete courses—it is to reduce risk. Organizations should focus on behavioral metrics that demonstrate real-world improvement and use those metrics to justify continued investment in training programs.
