Many organizations invest heavily in security tools, training completion rates, and compliance checklists, yet these often do not lead to a reduction of actual incidents. What actually predicts a lower number of security breaches is a mature security culture, that is, an organization’s shared attitudes, values, and behaviors such that security is everyone's responsibility.
Research has consistently demonstrated that organizations with mature security cultures experience up to 52% fewer security incidents than their peers and resolve incidents significantly faster than others. The key to doing this is to identify and utilize metrics that measure the key behaviors and attitudes required for substantive change instead of using vanity metrics (such as when a person completes required training).
Many of the traditional metrics that have been used to represent employee risk do not accurately represent employee risk in the context of the organizational environment.
Why Traditional Metrics Fall Short
Completion of required training, the number of employees who clicked on simulated phishing phishing emails, and the number of employees who signed off that they have reviewed and acknowledged new policies are not indicators of real risk.
Just because an employee completes required training does not mean they will demonstrate different behavior. Similarly, employees who click on simulated phishing emails may have a higher click rate because they are reporting more simulated phishing emails rather than that they are at a higher risk of actual phishing.
The most important predictor of future behavior is how people think and feel when they are not being observed or monitored, particularly in response to a real threat.
What Actually Predicts Fewer Incidents
The metrics and related processes from the following list have been shown to be correlated to lower rates of breach incidents and incident response time:
1. High reporting rates, especially for ‘good catches’ , How often employees are reporting suspicious emails, events and near misses in a timely manner is one of the best behavioral predictors of a secure workplace.
Organizations that aim for a high % (70+) reporting rate for email phishing simulation tests will see decreased time from the initial attack to the time that organizations detect the attack (day’s dwell time) and also see fewer successful attacks due to phishing.
High levels of reporting also indicate that employees feel psychologically safe in their position (the employee can admit their mistake without the fear of reprisal).
2. Psychological safety , Do employees trust the security team? Do you feel comfortable asking them questions?
3. Mean Time To Report (MTTR)/ speed at which employees report their experiences , The mean time for employees to report a real or simulated threat is a better metric than the click rate.
A quick report can reduce the amount of time from the initial attack until the organization detects the attack (in days) and limit the negative effects attributed to the cyber attack by limiting the duration of time the system is infected.
4. Proactive security behaviors, Examples of proactive security behaviors include (but are not limited to):
a) Employees asking security questions as they plan their projects;
b) Voluntarily participating in security awareness events; and
c) Not using unapproved software (shadow IT).
5. The leadership tone that executives set through participation in simulations, discussing security in meetings, and rewarding good security behavior has a direct correlation on incident rate reduction. The “Tone from the Top” is a very influential contributor to the overall security culture.
6. Organizations that treat incidents as opportunities to learn (not as an opportunity to punish) generally have an also recovering from an incident more quickly and have fewer repeating incidents within their organization.
7. Maturity Models (ex: KnowBe4, Proofpoint) show there is a point of inflection where going from basic compliance and awareness to some measure of Behavior Focused Security Culture and Sustainability results in a significant decrease in people-related breaches.
Practical Methods of Assessment of Security Culture
1. Surveys of Security Culture: Short, anonymous, periodic surveys that assess employee’s level of attitude, perceived responsibility, trust, and sense of psychological safety.
2. Measurable Behavioral Metrics from Security Simulations: Reporting rates, reporting timeliness, and reporting engagement measured over a period of time (not just overall failure rates).
3. Volume and Quality of Incident Reports: Generally speaking, the more voluntary reports received (especially for near misses) indicates a stronger overall culture.
4. Employee Sentiment and Employee Feedback about the Helpfulness vs. Burdensomeness of security practices.
5. Maturity Assessments using established framework models to provide benchmarks for your organization’s current state of security maturity from Ad Hoc Compliance through to Sustainable Proactive Culture.
Use both quantitative data (reporting rates, MTTD/MTTR) and qualitative perspectives (surveys and interviews) to provide a complete Security Culture assessment picture.
Actionable Steps to Build a Stronger Culture
1. Replace Compliance Based Training with Behavior Based Programs Using Realistic Simulations.
2. Publicly Celebrate Reports and "Good Catches" as an Incentive for Proactive Behavior.
3. Provide Psychological Safety for Employees so They Can Report Errors Without Fear.
4. Encourage Leadership Participation in Security/Compliance Initiatives.
5. Evaluate what is significant: For example; incident reports, response rate, positive or negative feelings about security, than just your completion percentages.
6. Go through the data on quarterly surveys to make necessary changes.
Key Takeaways
1. Completion of training and clicking are usually not strong indicators of an organization’s security success
2. Stronger indicators for fewer incidents were: Volunteer Reporting, Psychological Safety, Quick Reporting, Sentiment about Security in a positive way
3. Companies with an advanced security culture have seen upwards of 52% fewer incidents and quicker recovery time.
4. Measuring culture requires looking at behaviors and attitudes, not just compliance checkboxes.
5. Building a strong culture is one of the highest-ROI investments in cybersecurity, it turns employees from potential weak links into active defenders.
Start measuring the right things today: How many threats do your people report? Do they feel safe speaking up? The answers will tell you far more about your real risk level than any dashboard of training stats.
