A city social-engineering program defines success metrics for culture change. Which objective is most realistic and aligned with defensive practice?
Select an answer to reveal the explanation.
Short Explanation
Humans aren't firewalls with a perfect block list—people will click sometimes. What you want is 'report it and nuke it' muscle memory, not a fantasy of eternal zero clicks.
Full Explanation
Realistic municipal SE culture metrics emphasize durable defensive behaviors: recognize suspicious contact, refuse unsafe compliance, report promptly, and delete or quarantine as playbooks require. Promoting report-and-delete (or equivalent escalate-and-contain) behavior shrinks attacker dwell time even when occasional clicks occur. Permanent zero-click guarantees across every agency mailbox are neither psychologically healthy nor operationally realistic for human workforces.
Guaranteeing zero clicks forever fails by concept: it sets an unachievable perfection standard that punishes normal human error and can suppress reporting. Measuring success only by how loudly managers scold teams after failures rewards fear theater, not detection. Counting success solely by how many employees fear opening any email trains paralysis that harms legitimate civic operations and still does not prove resilient reporting habits.
Exam caveat: Lower click rates remain useful trend indicators, but they are incomplete without report rates, time-to-report, and quality of escalation. Fear-based programs can show temporary click drops while increasing shadow IT and underreporting. Align objectives with defensive outcomes: behavior change and control feedback, not humiliation.
Operational check: Track report-to-click ratios and median time from lure interaction to SOC ticket; sample whether reported messages receive timely acknowledgment; and retire any KPI that only rewards silence or manager volume of reprimands.