The CISO's Guide to Measuring Human Risk

Most organizations measure security awareness by a single number: the phishing click rate. While useful, it tells only part of the story. This guide presents a comprehensive framework for quantifying human cyber risk in language that resonates with boards.

Why click rates alone fall short

A click rate measures one behavior in one channel. It doesn't capture whether employees report suspicious emails, follow data handling procedures, lock workstations, or verify unusual financial requests. A low click rate can create false security if simulations aren't representative of real threats.

The Guard Human Risk Score (HRS) framework

Five dimensions combined into a single auditable score (0-100):

1. Phishing resilience (30%): Click rate, credential submission, attachment opens across difficulty levels
2. Reporting behavior (25%): Report rate and time-to-report for suspicious emails
3. Training engagement (20%): Completion rates, assessment scores, knowledge retention
4. Policy compliance (15%): Adherence to data handling, clean desk, access management
5. Incident response (10%): Performance in tabletop exercises and live drills

Benchmarking your score

• 90-100 (Excellent): Top 5%. Mature continuous program with executive sponsorship.
• 70-89 (Good): Regular training and simulations. Consistent security practices.
• 50-69 (Developing): Program exists but gaps in coverage, frequency, or measurement.
• Below 50 (At risk): Minimal or annual-only training. Significant exposure.

Board reporting: what to include

• Trend over time — Is human risk score improving quarter over quarter?
• Risk by department — Which business units have highest exposure?
• Industry comparison — How do you compare to sector peers?
• Real-world impact — Actual phishing attempts reported and stopped
• Investment ROI — Program cost versus estimated loss avoidance

The most effective board presentations tell a story: here's where we were, here's what we did, here's where we are, and here's what's next. Numbers without narrative don't drive investment.

Getting started

1. Run a baseline assessment across all five dimensions
2. Set quarterly improvement targets for each dimension
3. Implement automated reporting dashboards
4. Schedule quarterly board updates with trend analysis
5. Review and adjust annually based on evolving threats