The information security manager wants a metric that shows whether the security awareness program is actually changing employee behavior. Which metric is BEST?
Select an answer to reveal the explanation.
Short Explanation
Finishing a driving course doesn't prove you drive safely; how you actually behave on the road does. Reporting a suspicious email is the behavior you're after. The trap is the quiz score: it measures what people know, not what they do when the real thing lands in their inbox.
Full Explanation
An awareness program's purpose is to change behavior in ways that reduce risk, so its effectiveness is best measured by observable behavior. The rate at which staff report simulated phishing emails, tracked over time, shows whether employees recognize suspicious messages and take the desired action, and an upward trend indicates the program is working. It also supports incident detection, because reporting gives the security team early warning. Completion rates for the annual module measure participation, which is a compliance and activity figure; staff can complete training without changing how they act. The number of posters and newsletters distributed counts program outputs, saying nothing about whether anyone read them or behaved differently. Average quiz scores measure knowledge retained immediately after training, which is a useful intermediate indicator but does not show whether people apply that knowledge under real conditions. Exam caveat: report rate is generally a better behavior indicator than click rate alone, because it captures the positive action the organization wants, though many programs track both. Operational check: establish a baseline report rate, run simulations of comparable difficulty at regular intervals, and present the trend to management alongside real phishing reports received by the security team.