Living Security CEO Ashley Rose sits down with Edna Conway — former Chief Security Officer of Cisco's Global Value Chain and Chief Security & Risk Officer for Microsoft Cloud — to unpack what boards and CISOs actually want from your program. Hint: it isn't completion rates.
Your program says people completed training. Your CISO hears activity — not risk.
Meanwhile the game has changed: AI agents now share your people's identities, permissions, and attack paths, and attackers move in seconds while most programs still report quarterly.
Ashley and Edna get specific about the gap between what awareness programs report and what leadership actually needs to see — and how to close it.
Activity tells you what people clicked. Risk tells you what could happen next.
Completions, click rates, thumbs-ups on training modules — none of it answers the questions leadership is actually asking. Edna, who has chaired boards and sits on risk and audit committees, asks the same four things every time.
If your program can't answer those today, this session is your homework.
- What am I seeing?
- How are you monitoring it?
- How are you prioritizing it?
- And tell me — with empirical data — the difference it's making.
— Edna Conway, on what she asks every program owner
