Lesson 3.67: Security awareness that measures the right things
Most phishing simulations report one number: how many people clicked. That number mostly measures how hard the test email was. What protects an organisation is how many people report a phish, and how quickly the first report arrives, because the first report lets the security team pull the real email from every mailbox. In the lab you analyse Northwind's quarterly invoice-fraud simulation: overall results, results by department, the time to the first report, people who clicked twice in a row, and you plan targeted, blame-free follow-up.
15 min
You will learn to
- Explain which awareness metrics matter
- Compute rates with jq
- Compare departments
- Measure time to first report
- Plan targeted, blame-free follow-up
Key terms
- Click rate
- Share of recipients who clicked the link.
- Submission rate
- Share who entered credentials or data.
- Report rate
- Share who reported the email with the report button.
- Time to first report
- Minutes until the first person reports.
- Just-in-time training
- Short guidance shown right after someone clicks a simulation.
← Common attacks: phishing, malware, password attacks, denial of service · All lessons · PCI DSS v4.0: scope and segmentation →