Awareness Completion Rises While Phishing Clicks Double
A global professional services firm with 22,000 employees completed a security awareness program across 14 countries. LMS completion is 92%, but the phishing simulation click rate rose from 6% to 18% over two quarters following the acquisition of a 4,000-person consultancy with a different email culture. Repeated clickers account for 61% of clicks. The CISO's dashboard reports 'awareness program effective' based on completion. The CFO has cut the awareness budget by 20% for next year, citing high completion and no major incidents. You are asked to rework the program and its metrics within 30 days before budget lock. There is no security culture survey; the IT service desk reports a 35% increase in reported suspicious emails but also a 12% increase in false positives. The acquired firm's employees have not completed the same role-based training, and 9 of 14 country works councils require consultation before mandatory training changes.
1. Why do completion and click rate diverge, and what measurement changes would you propose?
Read the worked answer
Completion measures exposure to content, not behavior. The acquisition introduced a cohort with different email norms; 61% of clicks come from repeat clickers, so the average hides a concentrated problem. Simulations may also have become harder or less realistic, and reporting culture may be improving with 35% more reports even as clicks rise. Propose behavior-based metrics: repeat click rate excluding first-time clickers, report rate, median time-to-report, false-positive ratio, and role-based simulation performance. Segment by business unit, tenure, and acquired versus legacy population. Add a short culture pulse survey and service-desk ticket analysis. The program manager should explain that 92% completion plus rising clicks means the program is measuring attendance, not capability; a smaller targeted program aimed at repeat clickers may outperform a broad completion push. This is judgment because the easy response - more mandatory modules - would likely raise completion again without changing behavior.
2. What 30-day plan would you propose to justify or reallocate the budget before it is locked?
Read the worked answer
In 30 days: analyze 12 months of simulation data by cohort; identify the top 5% repeat clickers and their roles; interview the service desk about report quality; run a baseline culture pulse in the acquired firm; and calculate cost per successful report and cost per click. Propose reallocating, not just defending, the budget: keep mandatory baseline training, shift spend to targeted coaching, realistic simulations, and report-recognition incentives. Present the CFO with a choice: fund targeted intervention at the current budget or accept a documented increase in repeat-click risk under a 20% cut. If the cut stands, define a minimum viable program with quarterly simulation, high-risk role coaching, and report triage, and record the residual risk. This is judgment, not recall: the program manager must connect spend to behavior change and give the CFO a defensible tradeoff rather than a generic plea for security funding.
3. Which leading indicators should the program manager report to the CFO?
Read the worked answer
Report leading indicators: repeat click rate trend, report rate and time-to-report, false-positive rate, coverage of high-risk roles in finance, engineering, and executive ranks, simulation difficulty calibration, and completion by acquired cohort. Pair each with a target and a trend, not a single snapshot. Explain why completion is a lagging administrative metric and why report rate is a better proxy for culture. Include cost-avoidance estimates only with assumptions stated. The program manager should also flag that a 20% cut may reduce the very activities that improved reporting, so the CFO sees the second-order effect. The reasoning: the CFO is making a portfolio decision under uncertainty; leading indicators let finance compare security spend with observable behavior risk, while lagging completion data invites a cut that looks safe but is not.