Brain Security · Cybersecurity and AI awareness

Catalogue

How do you measure the effectiveness of a cybersecurity awareness programme?

Track participation first, then quiz score progress, then behaviour: click rate and reporting rate in phishing simulations, time to report, incidents declared. No single metric is enough on its own: cross-check them at regular intervals and compare with the previous period. Brain Security provides participation, progress and completion by default, with exports.

Updated 3 November 2026

Why participation comes first

A programme nobody follows changes no reflex. If only the most motivated people play, your scores and rates describe the converted, not the company. So measure first the share of your teams that takes part, before asking what they learned. The other metrics only mean something for an audience that actually played.

Useful metrics, with their limits

MetricWhat it measuresIts limit
Participation and completionWho plays, and who sees the course through.Says people showed up, not that they understood. Read it before anything else.
Quiz score progressWhat people know, theme by theme, and how it changes from one key moment to the next.A quiz measures knowledge, not behaviour. A score can rise simply because the questions repeat.
Click rate and reporting rate in phishing simulationsThe reflex facing a fake email: who clicks, who reports.Depends on how hard the scenario is. Compare campaigns of the same level and look at reporting as much as clicking.
Time to reportHow fast a suspicious message reaches the security team.Needs reliable timestamps and enough reports for the average to mean something.
Incidents declaredThe number of incidents employees raise on their own.A rise can be a good sign, because people declare more. The causes are many: read it with care.

How often to measure

Participation is tracked continuously during a key moment, with a review at the end. Scores are compared from one key moment to the next. A phishing simulation is read campaign after campaign, with scenarios of the same difficulty. Incidents can only be judged over a year, because they are too rare for a shorter reading. Set the dates before you start and keep the same metrics from one period to the next.

How Brain helps, product by product

Cyber Cup and Super Challenge give participation, ranking and progress theme by theme, with a skills map and CSV or XLSX exports; you can try them with a free account. Super Phisher, by appointment, shows who clicked and who reported, with the reporting rate, campaign by campaign. Chat with Jack, in Slack and Microsoft Teams (Google Chat coming soon), by appointment, offers a dashboard of progress, quizzes and reports. The Brain Platform brings them together in a single programme, with a training record; it is not self-service, and it is set up after a conversation with our team. Time to report and incidents declared come from your own tools: email, support, security team.

Frequently asked questions

Participation: the share of your teams that really plays and finishes. Without it, scores and click rates only describe the most motivated people. Cyber Cup and Super Challenge give participation, progress and completion exports.

No. A low click rate can come from an easy scenario or a campaign few people saw. Look at the reporting rate too: someone who reports protects others, someone who does not click does not always raise the alarm. Super Phisher shows both, campaign by campaign.

Article 4 of the AI Act asks companies to take measures to develop the AI literacy of their staff. What matters is showing the actions taken: participation, progress by theme and exports. A Super Challenge in the AI universe, tried with a free account, leaves that trace.

On the cabinet, no personal data is collected on players. Online, there is no player account: only a nickname and a score. You then measure the participation and progress of the players.

Read next