BLOG

Why ROI Is Hard to Measure, and How to Fix It

The core challenge is that security awareness training is a control designed to prevent events that are inherently difficult to count. You cannot easily measure phishing emails that were not clicked, business email compromise attempts that were reported before money moved, or credentials that were not entered into a spoofed login page. Prevention is invisible by nature.

This leads most programs to default to the one metric that is easy to count: training completion rates. A 94 percent completion rate sounds like evidence of program effectiveness. It is actually evidence of scheduling effectiveness. The two are not the same.

The fix is to measure what the program is actually trying to change: human behaviour under simulated threat conditions.

Phishing click rate over time

The most direct measure of awareness program effectiveness is the simulated phishing click rate, tracked monthly, across the organization and segmented by role and department. A well-run program drives this metric down over six to twelve months and holds it there. The starting click rate for organizations without continuous training typically runs between 25 and 40 percent. Programs that run monthly simulations consistently drive this below 5 percent within a year.

Phishing report rate

Click rate is a measure of failure. Report rate is a measure of active defense. Employees who recognize a suspicious message and report it through the designated channel are functioning as a human sensor layer, extending the security team’s visibility into active phishing attempts against the organization. Rising report rates are a leading indicator that security culture is changing, not just security behaviour.

Mean time to report

Beyond whether employees report suspicious messages, the speed at which they report matters. An employee who identifies a phishing attempt within minutes gives the security team a chance to pull the message from other inboxes before the campaign succeeds. Tracking mean time to report, and trending it over time, gives the program a metric that translates directly into incident response advantage and feeds the wider managed SOC picture.

Repeat-clicker rate and cohort size

In most organizations, a small percentage of employees account for a disproportionate share of simulated phishing clicks. Identifying this cohort, measuring its size over time, and tracking whether targeted intervention is reducing it is one of the most actionable metrics a security awareness program can produce. A shrinking repeat-clicker cohort is measurable, attributable risk reduction.

Risk score trend by role and department

Aggregated risk scoring across roles, departments, and geographies transforms individual behavioural data into organizational intelligence. A finance team with a rising risk score warrants different attention than an IT team with a stable trajectory. Trend lines over time tell the board a story that completion certificates cannot.

84%  reduction in click rate achievable within 12 months of a continuous monthly simulation program.

3-7x  higher report rates in organizations running continuous awareness versus annual-only programs.

$4.91M  average cost of a breach involving a phishing attack (IBM 2025 Cost of a Data Breach Report).

Translating Metrics Into Board Language

Risk reduction metrics are necessary but not sufficient for board-level ROI conversations. Boards think in dollars, liability exposure, and reputational risk, not click rates. The translation requires a bridging framework.

Cost avoidance framing

The average cost of a data breach attributed to a phishing attack now approaches five million dollars when direct and indirect costs are included. A program that demonstrably reduces phishing susceptibility is not an expense, it is a risk transfer mechanism with a measurable expected value. Framing the program’s cost against the probable cost of an avoided incident, weighted by the likelihood reduction the data supports, produces a defensible ROI estimate that finance and the board can evaluate.

Cyber insurance premium positioning

Cyber insurers are increasingly segmenting premiums based on the quality of the insured’s security awareness program. Organizations that can demonstrate continuous training, monthly simulated phishing, documented risk score improvement, and audit-ready compliance evidence are consistently offered better terms. Quantifying the premium differential is a direct financial ROI figure that requires no modeling assumptions.

Compliance cost avoidance

Regulatory fines, audit failures, and the cost of remediation following a compliance finding are measurable. An awareness program that generates continuous, audit-ready evidence for PIPEDA, SOC 2, ISO 27001, and NIST CSF reduces the probability and severity of compliance findings, the same discipline behind broader compliance readiness. The cost avoidance is the difference between walking into an audit with structured evidence and scrambling to reconstruct a program history in the weeks before the auditor arrives.

Building a Reporting Cadence That Holds Up

ROI evidence is only as useful as the cadence through which it reaches decision-makers. A quarterly executive report that translates operational data into risk reduction outcomes gives the board a consistent view of program performance, not a once-a-year summary of completion rates, and it is the kind of governance a vCISO is built to run.

The report structure that works covers: organizational risk score trend, click and report rate trajectory, repeat-clicker cohort size and direction, compliance evidence status, and the residual high-risk cohorts that warrant additional investment. Each metric is benchmarked against the prior quarter, the program baseline, and industry data.

That report is also the artefact that survives a CISO transition, a board composition change, or an insurer review. It documents a story of continuous improvement that a completion spreadsheet cannot tell.

The Bottom Line

Measuring the ROI of cyber awareness training is not a theoretical exercise. It requires a program designed to produce measurable behavioural data, not just completion certificates, and a reporting framework that translates that data into the language of risk, liability, and financial exposure. Organizations that build this capability find the board conversation shifts from “how much does the training cost” to “how much risk has the program removed.” Armour’s managed cyber awareness training delivers quarterly board-ready reporting with every engagement. Schedule a discovery call to discuss your measurement requirements.

Awareness training rarely works alone. It is one pillar of Armour’s managed cybersecurity services, operating alongside a managed Security Operations Center for detection, cyber threat intelligence on live adversary behaviour, vulnerability management for the technical layer, vCISO leadership for governance, and the all-in-one Armour 360 managed program.

Frequently Asked Questions

How do you measure the ROI of cyber awareness training?

A: You measure it in two layers. First, behavioural metrics that prove risk reduction: simulated phishing click rate over time, report rate, mean time to report, repeat-clicker cohort size, and risk-score trends by role. Second, a translation of those into financial terms the board understands: cost avoidance against the roughly 4.9 million dollar average phishing breach, cyber insurance premium improvements, and reduced compliance-finding risk.

Why are completion rates a poor measure of awareness training?

A: Because completion measures scheduling, not behaviour. A 94 percent completion rate tells you people finished the course, not that they will hesitate before clicking a well-crafted phishing lure months later. The same completion rate is consistent with a real-world click rate that has not improved in years. Effectiveness has to be measured through simulated-threat behaviour, not attendance.

What metrics show whether security awareness training is working?

A: The most useful are: simulated phishing click rate (tracked monthly and segmented by role), report rate (how many employees actively report suspicious messages), mean time to report, repeat-clicker cohort size and its direction over time, and aggregated risk-score trends by team and department. Together these show whether behaviour, not just completion, is improving.

How does cyber awareness training affect cyber insurance premiums?

A: Insurers increasingly segment premiums by the quality of an organization’s awareness program. Those that can demonstrate continuous training, monthly simulated phishing, documented risk-score improvement, and audit-ready evidence are consistently offered better terms. The premium differential between a documented continuous program and an annual-only one is a direct financial ROI figure that needs no modeling assumptions.

What should a board-level awareness training report include?

A: A quarterly report that covers organizational risk-score trend, click and report-rate trajectory, repeat-clicker cohort size and direction, compliance evidence status, and the residual high-risk cohorts needing investment. Each metric should be benchmarked against the prior quarter, the program baseline, and industry data, so the board sees a continuous-improvement story rather than a completion summary.