Lesson 4.66: Reading a security culture survey
Awareness metrics (Intro 201) show what people do; a culture survey asks what they think and feel: do they know how to report, do they feel safe admitting a mistake, do the rules fit their work? Averages hide the useful part, so you look by department, protect anonymity and turn answers into actions for the organisation, not blame for individuals. In the lab you analyse Northwind's 2026 survey with awk and write the three actions it points to.
16 min
You will learn to
- Explain what a culture survey measures that metrics don't
- Compute averages and agreement rates from Likert data
- Segment results by department
- Protect respondents' anonymity with a minimum group size
- Turn results into organisational actions
Key terms
- Security culture
- The shared beliefs and habits that shape how people behave about security when nobody is checking.
- Likert scale
- A 1-5 (or 1-7) agree/disagree scale used in surveys.
- Psychological safety
- Believing you won't be punished or humiliated for admitting a mistake.
- Minimum group size
- Not reporting segments too small to keep respondents anonymous.
- Blameless review
- Analysing an incident to fix systems, not to punish people.
← Records of processing activities · All lessons · International data transfers →