A board-ready human risk scorecard should answer three questions: where are people-related controls failing, is the exposure moving in the right direction and what decision does management need to make?
Training completion alone cannot answer those questions. It shows that an activity happened, but not whether employees report threats, follow high-risk processes or repeat unsafe actions. A useful scorecard combines coverage, behaviour and control performance while keeping the calculation behind every number visible.
The NIST Cybersecurity Framework 2.0 treats governance and oversight as part of cybersecurity risk management. NIST's information security measurement guide also recommends selecting measures that support decisions. That is a good test for every metric on the page: if nobody knows what decision it should inform, remove it.
Start with decisions, not available data
List the decisions leaders may need to make during the next two reporting periods. Examples include funding a reporting tool, changing a payment-verification process, focusing training on a role or accepting a documented residual risk.
Then work backwards to the evidence. A board usually needs trends, concentration and consequences. It does not need every event collected by the training, email or identity platform.
For each metric, document:
- the question it answers
- its numerator, denominator and exclusions
- the systems that provide the data
- the owner responsible for explaining changes
- the reporting period and comparison period
- the action that should follow a material change
This definition sheet prevents a familiar problem: two teams using the same label for numbers calculated in different ways.
Six metrics for a practical scorecard
The right set depends on your risks and controls. The following six provide a useful starting point without pretending to calculate the probability of a breach.
1. Phishing reporting rate
Definition: unique recipients who correctly report a simulation divided by recipients who received it.
Reporting shows that employees can turn suspicion into an action that gives the security team a chance to respond. Keep incorrect or duplicate reports separate so the rate remains understandable. State whether the measure covers simulations, confirmed real messages or both.
2. Time to first report
Definition: the median time from delivery to the first valid employee report for each measured message or exercise.
A median is less distorted by a few very late reports than an average. Show the period and sample size. If the reporting route or simulation design changes, annotate the chart because the new process may affect the trend.
3. Repeat high-risk action rate
Definition: people who repeat a clearly defined risky action during the period divided by people who had a comparable opportunity to repeat it.
Choose the action before looking at the result. It might be entering credentials in two comparable simulations or bypassing a required verification step more than once. Do not combine unrelated actions into one rate unless the model and weighting are documented.
4. High-risk process adherence
Definition: sampled high-impact requests that followed every required verification and approval step divided by all sampled requests in scope.
This connects human behaviour to an operational control. Possible samples include changed supplier bank details, privileged account recovery or requests to release sensitive data. Record why a step failed so the owner can distinguish a knowledge gap from an unusable process.
5. Priority-role training coverage
Definition: people in defined high-exposure roles who completed the relevant learning or exercise divided by all people in those roles.
Coverage remains useful when it is tied to risk. Finance staff may need payment-fraud exercises, while service-desk staff need account-recovery scenarios. Present this as evidence of reach, not proof that risk fell.
6. Overdue remediation
Definition: the number of known people-related control gaps past their agreed due date, grouped by severity and age.
Examples include a missing supplier contact, an unclear reporting route or a team without a tested recovery procedure. This metric makes the management task visible. A growing backlog can explain why behavioural results are not improving even when training coverage is high.
Industry sources use similar inputs. For example, CybSafe's guidance for CISOs names completion, phishing clicks and reports, dwell time, resilience and policy compliance. CybSafe also argues that a risk calculation needs a view of likelihood and impact. Treat that as vendor guidance, and keep a descriptive scorecard separate from formal risk quantification unless your organisation has a validated model.
Use a scorecard the board can read in one page
Give each metric one row with the same columns:
| Metric | Current period | Previous period | Direction | Interpretation | Owner and next action |
|---|---|---|---|---|---|
| Reporting rate | Enter value | Enter comparison | ↑ / → / ↓ | What changed and why it matters | Named owner and action |
| Time to first report | Enter value | Enter comparison | ↑ / → / ↓ | Context, sample and limitation | Named owner and action |
| Repeat high-risk action | Enter value | Enter comparison | ↑ / → / ↓ | Where repetition is concentrated | Named owner and action |
| Process adherence | Enter value | Enter comparison | ↑ / → / ↓ | Which step fails most often | Named owner and action |
| Priority-role coverage | Enter value | Enter comparison | ↑ / → / ↓ | Which roles remain uncovered | Named owner and action |
| Overdue remediation | Enter value | Enter comparison | ↑ / → / ↓ | Oldest or highest-impact gaps | Named owner and action |
Do not fill empty cells with estimates. Mark missing data as unavailable, explain the coverage gap and assign the work needed to collect it. A blank with an owner is more credible than a precise-looking number built on an unknown denominator.
Add context without exposing individuals
Segment results only where a group is large enough to interpret fairly and protect confidentiality. Useful views may include role, business unit, geography or type of control. Small teams can make an apparently anonymous result easy to trace back to a person.
Use segmentation to find a process or support need, not to publish a league table of employees. Limit detailed data to the people who need it for remediation. The board scorecard should stay at the level required for oversight.
Compare like with like. Changes in employee population, simulation difficulty, reporting tools or measurement rules can move a metric without a corresponding change in risk. Put those changes beside the chart and keep the underlying definition stable long enough to show a meaningful trend.
Avoid a composite score you cannot explain
A single human risk score can be useful when its inputs, weights, refresh rules and limitations are documented. Without that model, combining six measures can hide more than it reveals. A higher reporting rate may improve while an overdue control gap remains serious; one blended number can obscure both facts.
If you use a score, let leaders open it and see the contributing measures. State whether it is a relative indicator, a control-performance measure or an estimate of risk. Do not present it as breach probability unless the method supports that claim.
Turn the scorecard into a management conversation
End each reporting cycle with one concise narrative:
- What changed? Name the most material movement or concentration.
- Why did it change? Separate observed evidence from your explanation.
- What are we doing? Give the action, owner and date.
- What decision is needed? Ask for funding, priority, risk acceptance or cross-functional support when required.
Link the discussion back to security awareness training, operational controls and incident learning. Training is one input to human risk management, not the whole programme.
Start with three metrics you can define and verify, then add measures when they support a real decision. Clear definitions and honest gaps will give the board a better view of human risk than a crowded dashboard of unexplained percentages.
