Stop reporting completion: measuring human risk instead of attendance

Completion is the metric most awareness programmes report because it is the metric most awareness platforms produce. It answers a question nobody senior asked: did people open the thing we sent them.

Three groups, ten factors

A usable model separates what people fall for, what they do about it, and how much attack surface their role carries. Collapsing those three into one average is how a department full of fast reporters ends up looking identical to one that ignores everything.

Susceptibility

Susceptibility rate, credential-submit rate, time-to-click and repeat-clicker rate. This is the group most programmes already measure, usually as a single click percentage.

Resilience

Report rate, real-threat response and training completion. This is the group that predicts future outcomes, and the group most often missing from a board slide.

Exposure

Multi-channel reachability, tenure risk and department risk. Without it, a team that hires heavily or handles payments is permanently penalised for its job description.

Why a letter grade rather than a percentage

A percentage invites an argument about a two-point move that means nothing. A band moves when behaviour moves. Grading resilience rather than risk also fixes the polarity problem: higher should always be better when a letter is attached.

What to put in front of a board

1. The graded score and its direction of travel.
2. Phish-prone rate, so the number has a familiar anchor.
3. Report rate, as the leading indicator.
4. Your percentile against comparable organisations.

Completion goes in the appendix, where operational metrics belong.