Security Training Completion Is 100% and Nothing Changed

The annual report says 100 percent of employees completed security training. It sounds like a win. Then someone clicks a bad link anyway, and nobody is surprised.

Completion measures attendance. It tells you who finished a course, not whether anyone does anything differently on Monday morning.

If you want to know whether training works, measure behavior. Four simple measures do most of the job.

TLDR

• Completion rate measures attendance, not behavior.

• Four behavior measures: reporting rate, simulation response, repeat clicks and time to report.

• A rising reporting rate is often a better sign than a falling click rate.

• Use the numbers to improve the program, not to blame individuals.

• Report the trend to leadership each quarter.

Why completion is not enough

Completion is easy to count, which is why it is so common. But a person can finish a course in a hurry, retain little and go back to old habits.

NIST's guidance on building a cybersecurity and privacy learning program describes a life-cycle approach to building and managing such programs, rather than a one-time course. A program managed over time needs measures that show whether it is doing its job.

The behavior panel

Four measures give a clear picture. The numbers below are illustrative.

Measure (illustrative)	Last quarter	This quarter	What it tells you
Reporting rate: share of suspicious emails staff report	18%	27%	People are noticing and speaking up
Simulation response: share who click a test phishing email	14%	11%	Fewer people fall for the obvious ones
Repeat-click rate: share of clickers who click again	40%	31%	Follow-up help is working
Time to report: median minutes from receipt to report	95	40	Problems reach security sooner

No single row tells the whole story. Together they show whether people notice, report and learn.

Why reporting matters most

A falling click rate can mean people are more careful. It can also mean the test was easier, or that people have learned to spot tests. A rising report rate is harder to fake. It means more people are paying attention and are willing to tell someone.

Speed matters as well. A report within minutes can stop an attack that a report next week cannot.

Use it to help, not to punish

If people fear punishment for clicking, they stop reporting. Use the data to find who needs more help and which topics confuse people. Offer short, specific follow-up.

For why culture matters more than checklists, see from checklists to culture.

Frequently asked questions

Is completion rate ever useful?

Yes, as a basic check that everyone received the training. It is just not evidence that the training changed anything.

What is a good click rate on phishing tests?

It depends on how hard the tests are, so compare your own results over time rather than against a single target. The trend matters more than any one number.

Should we punish people who click?

No. Punishment discourages reporting, which is the behavior you most want. Use clicks to guide extra help.

How often should leadership see these numbers?

Quarterly is enough for most organizations, with a short note on what changed and why.

A Defensible Next Step

Ask your security team for the four measures for the last four quarters. If they cannot supply them, that is the first thing to fix. Book a Decision-Clarity Call if you would like help building the panel.