Measuring what matters: How security awareness metrics matured in 2023

For as long as security awareness training has existed, the metric most organizations tracked was also the least informative one: completion rate. A dashboard that showed ninety-eight percent of employees had finished their annual training looked reassuring, but it answered the wrong question. It said people had sat through the material, not that they had learned anything, changed any behavior, or become any harder to trick. Through 2023, that began to change. Programs started measuring what actually matters, and the result was a far more honest picture of the human layer. Here is how security awareness metrics matured, and what a meaningful measurement program looks like.

Completion is the floor, not the goal

Completion rate is not worthless, it is simply insufficient. It matters because compliance frameworks and insurers ask for it, and because a program that cannot get people through training has a delivery problem. But completion measures participation, not outcomes. Two organizations can both report ninety-eight percent completion, yet one has a workforce that routinely falls for phishing and another that catches nearly every attempt. The difference is invisible in the completion number. In 2023, mature programs began treating completion as a hygiene metric, something to track and maintain, while shifting their attention to measures that reflect actual resilience.

Click rate became the headline metric

The most meaningful single number to emerge was the phishing simulation click rate, the share of employees who click a simulated phishing message. It is imperfect, but it is a direct, repeated measurement of whether training is sticking. The value is not in any single simulation, which can be skewed by difficulty, but in the trend. A click rate that falls quarter over quarter tells a story that completion alone cannot: the workforce is actually getting better at recognizing attacks. A click rate that stays flat, or worse, rises, is an early warning that the training content is not landing. This trend data became the backbone of serious awareness measurement.

Reporting rate became the metric for culture

Click rate measures resistance, but it does not capture the other half of the story: whether employees report suspicious messages. Reporting rate, the share of simulated phishes that employees flag to security, became the leading indicator of a healthy security culture. A workforce that clicks little and reports a lot is far more resilient than one that simply does not click, because reporting gives the security team early warning of real attacks. In 2023, organizations learned to celebrate reporting, not just low click rates, because an employee who reports a near-miss is as valuable as one who never fell for it.

Beyond phishing: the limits of any single number

The most important lesson of 2023 was that no single metric captures the human layer. Phishing click and reporting rates are useful, but they measure only one threat vector. They say nothing about password hygiene, data handling, incident reporting in general, or whether employees understand the policies that apply to their role. Mature programs recognized that phishing simulations are a sample, not the whole picture, and paired them with other signals: help-desk ticket volume, the frequency and speed of real incident reports, and periodic knowledge checks. The goal was a portfolio of measures, not one scoreboard.

Metrics as a feedback loop, not a report card

The deepest shift was conceptual. In 2023, metrics stopped being something to report upward and became something to act on. A rising click rate on a particular lure was not a reason to shame a team, it was a signal to update the training content. A spike in reports about a specific kind of email was a prompt to investigate whether a real campaign was underway. Measurement became the input to a feedback loop: train, test, measure, identify gaps, retrain, and test again. The organizations that adopted this mindset stopped treating the human layer as a black box and started managing it like any other control, with data driving improvement.

What a meaningful program measures

The practical takeaway for 2023 was a short list of metrics that, together, tell a real story: completion rate, to confirm delivery and satisfy compliance; phishing click rate over time, to measure whether training is sticking; reporting rate, to gauge culture and early-warning capability; and the trend in real-world incidents that begin with human error, the ultimate measure of whether the program is reducing risk. None of these is sufficient alone, but together they turn security awareness from a vague annual ritual into a measurable, improvable control, and the research on whether training actually reduces security incidents makes the case for why that measurement is worth the effort. That was the maturation that defined 2023.