The 31% click rate on the board dashboard
NordWest Logistiek is a 900-employee logistics company with 14 depots. Its security policy was last revised in 2019 and names no owner. Security awareness consists of an annual 20-minute e-learning module and a quarterly phishing simulation. Last year's simulation had a 31% click rate and a 9% report rate; after mandatory e-learning the click rate fell to 28%. The CEO wants repeat clickers named in team meetings and disciplined. The helpdesk receives about 30 suspicious-email reports per month, but employees often forward them to colleagues instead of reporting. There are no security responsibilities in job descriptions, and the works council has raised concerns about monitoring. ISO 27001 certification is planned for next year. The CISO has one awareness budget of €40,000 and no dedicated awareness role.
1. Diagnose the governance gaps and explain why public naming or discipline is likely to reduce reporting rather than reduce risk.
Read the worked answer
Governance gaps
- The policy is stale, unowned and not reviewed, so it cannot set clear expectations.
- Security responsibilities are absent from job descriptions and manager objectives.
- Awareness is an annual event, not a managed programme with feedback and measurement.
- The reporting route is unclear and slow; staff forward emails to colleagues instead of using a report button.
- The works council has not been consulted on monitoring, which creates legal and trust risk.
- The board sees a single click-rate number and is steering by it.
Why naming and discipline backfire Punishment turns a security report into a confession. People who fear blame hide mistakes, delay reporting and avoid asking questions. That increases attacker dwell time and reduces the chance of containing a real phishing email. The 31% click rate is also a systems signal: lures may be realistic, reporting may be hard, and staff may not know what happens after they report. The improvement from 31% to 28% after e-learning is too small to justify a punitive programme. The CEO should model reporting, not shame individuals. Any monitoring must be proportionate and agreed with the works council.
2. Design a measurement set for the awareness programme that goes beyond click rate. Explain what each metric tells the board and its limitations.
Read the worked answer
Metrics
- Report rate - the percentage of simulated phishing emails reported. It shows detection participation, not just failure.
- Median time to report - how quickly staff report. This is a better proxy for containment than click rate alone.
- Credential-entry rate - the percentage who enter data on a fake login page. This is more serious than a click and should drive phishing-resistant MFA, not blame.
- Repeat click rate - useful for targeting support and process fixes, but never for naming individuals.
- Real incident reports and helpdesk false-positive rate - shows whether the reporting channel is trusted and usable.
- Adoption of phishing-resistant MFA - a control metric that reduces dependence on user judgement.
Limitations Simulations vary in difficulty, seasonal workload affects results, small departments produce noisy numbers, and people can learn to game the test. A fall from 31% to 28% after e-learning is not proof of culture change.
The board dashboard should show trends, department-level patterns and time to report, plus one or two qualitative stories. Use the data to improve the system, not to rank employees.
3. Allocate the €40,000 and assign responsibilities across top management, the CISO, line managers, HR and staff. Justify your choices.
Read the worked answer
Allocation of €40,000
- Report button and triage workflow, with feedback to reporters: highest priority, because reporting friction is visible.
- Short role-based modules for finance, helpdesk and depot managers, rather than one generic annual module.
- Manager toolkit and team exercises: low cost, high reinforcement.
- Phishing-resistant MFA pilot for high-risk roles: reduces reliance on click behaviour.
- Measurement and works council consultation: necessary for legitimacy.
Responsibilities
- Top management: approve the policy, risk appetite and budget; model reporting; review metrics.
- CISO: own the programme, policy, metrics and feedback loop; advise on risk.
- Line managers: make time for training, reinforce reporting, never punish honest mistakes.
- HR: embed security responsibilities in job descriptions, onboarding and disciplinary policy.
- Staff: report suspicious messages and follow the acceptable-use policy.
ISO 27001 evidence Approved policy, training records, management review minutes, metrics trends, corrective actions and consultation records. The aim is a culture where reporting is normal, not a competition for the lowest click rate.