The program measures what it delivers. Training completion and phishing simulation click rate are the only numbers, collected from one platform and reported as organization-wide averages. Nobody in the program knows who attackers target or who holds sensitive access.
How to use this plan
Six practices. For each one, the actions that move you to level 2, Observing, then the quick wins to start this quarter: Easy playbooks. Each playbook names an owner, a week window inside the 90 days, and the number that proves it worked. Print it, assign the owners, and run the assessment again in 90 days.
- 6practices
- 7quick wins (Easy playbooks)
- 13weeks
01 · See
Which signals can you see, for whom, and how fresh are they?
At level 1: One source, two numbers: training completion and simulation clicks.
What moves you to level 2
- Count reported simulations and reported real emails per person.
- Pull MFA enrollment per person from the identity provider.
- Ask email security for a monthly list of targeted people.
- Record the source and refresh date of every number the program reports.
Quick wins this quarter · Easy playbooks
- Count reported simulations per personEasy · weeks 1–2
Add report-button data to the program export and count reports per person next to clicks. Reporting is the first vigilant behavior and it costs nothing to collect.
MetricReport rate per person and per team · owner: Security awareness lead · connector: SAT
- Ask email security for the monthly targeting reportEasy · weeks 2–4
Request a monthly export of who received real phishing and impersonation attempts. It shows which people attackers pick before any connector exists.
MetricTargeted people listed by name each month · owner: SOC · connector: EMAIL
02 · Understand
How do you decide who needs attention, and what tells you the decision was right?
At level 1: Organization-wide averages; everyone gets the same attention.
What moves you to level 2
- Compute a per-person and per-team score from simulation and reporting results.
- List repeat clickers (three or more clicks in 180 days) by name.
- Ask the SOC for the count of human-related incidents by type over the last 12 months.
Quick wins this quarter · Easy playbooks
- List repeat clickers by nameEasy · weeks 1–2
Pull people with three or more clicks in 180 days from the simulation platform. The list is the first cohort the program can act on.
MetricRepeat clickers as a share of the workforce · owner: Security awareness lead · connector: SAT
03 · Act
What changes when risk is found, how fast, and who or what makes the change?
At level 1: The same training and simulations for everyone; no response changes a control.
What moves you to level 2
- Send a nudge inside 24 hours of a risky action.
- Pick two behaviors that trigger follow-up content.
- Agree a manual MFA reset path with the identity team for confirmed compromise.
Quick wins this quarter · Easy playbooks
- Send a nudge inside 24 hours of a simulation clickEasy · weeks 1–3
Replace the remedial module with a short nudge delivered the same day. Timing changes behavior more than length does.
MetricMedian hours from click to nudge · owner: Security awareness lead · connector: SAT
04 · Prove
Can you show, with your own numbers, that risk went down?
At level 1: Completion percentage for auditors.
What moves you to level 2
- Report the report rate next to the click rate, and the ratio between them.
- Report trends quarter over quarter per team.
- Send a one-page report to the CISO each quarter.
Quick wins this quarter · Easy playbooks
- Publish the report-to-click ratioEasy · weeks 1–2
Report reports divided by clicks per simulation, next to completion. The ratio is the first number that shows vigilance.
MetricReport-to-click ratio · owner: Security awareness lead · connector: SAT
05 · Govern
Who owns human risk, and what decision rights, budget and policy do they hold?
At level 1: The awareness lead alone, with a training mandate.
What moves you to level 2
- Write a one-page charter naming owner, scope, partners and reporting cadence.
- Add the GRC lead to the program review.
- Publish an AI acceptable-use policy.
Quick wins this quarter · Easy playbooks
- Write a one-page program charterEasy · weeks 1–2
Name the owner, scope, partners, reporting cadence and the decisions the program can make. A charter is the first governance artifact anyone will ask for.
MetricCharter signed by the CISO · owner: Security awareness lead
06 · Culture
Do people report, ask for help, and tell you the truth about friction?
At level 1: Culture unmeasured; attendance is the only engagement number.
What moves you to level 2
- Count reports of suspicious activity each month.
- Open a help channel and log requests.
- Run a three-question pulse on NPS, friction and confidence.
Quick wins this quarter · Easy playbooks
- Count reports of suspicious activity each monthEasy · weeks 1–2
Count every report from the button, the help desk and email, and publish the number. What gets counted gets noticed.
MetricReports per 100 people per month · owner: Security awareness lead
Why one field
The plan is already on this page.
The PDF is the same plan laid out for paper, so you can hand it to the owners. We ask for a work email and nothing else; no sales call unless you book one.
Not your level? Take the assessment: four minutes, and the result links the right playbook.
