Which metrics are commonly used to measure the effectiveness of security awareness training?

• A. Click-through rates, reporting rate, simulated phishing results
• B. Training duration and pass/fail rate
• C. Number of modules completed
• D. User satisfaction surveys only

Answer: (A)

Measuring effectiveness in security awareness training focuses on actual user behavior and how it changes in response to training. Click-through rates show how often people fall for simulated phishing emails, which directly reflects susceptibility and learning transfer from the training. Reporting rate measures how often users report suspicious emails to the security team, indicating they’re applying the proper response procedures. Simulated phishing results provide a controlled, realistic assessment of how well the training equips users to recognize and avoid phishing attempts, often across varying scenarios and over time. Together, these metrics give a practical view of whether the training reduces risk, not just whether people were engaged or satisfied.

Other options miss that behavioral and outcome focus. Training duration and pass/fail rate tell you how long was spent and how well someone demonstrated knowledge, but not whether they apply it in real email situations. The number of modules completed shows volume of content consumed, not impact on behavior. User satisfaction surveys capture opinions, not whether security behaviors actually improved.