Human Risk
Awareness training mostly measures whether people sat through it. This measures whether exposure went down, and treats the people involved as the defense rather than the fault.
Annual training is a record, not a control.
Most awareness programs exist to be evidenced. They produce a completion rate, a certificate, and a line in an audit response, and none of those numbers say anything about whether the organization is harder to phish than it was last year.
The useful measure is behavioral and comparative: does this cohort report faster than it did, does that team still click at the same rate, and has exposure moved where the access is concentrated. S32 Technologies builds the program around that question, because it is the only one a board or a regulator can act on.
From measurement to behavior change
Assess
Establish where exposure actually sits by role, team and system access, before deciding what anyone needs to be taught.
Train
Role-based curricula that match what a person can actually do in your systems, not a single annual module for everyone.
Simulate
Phishing and pretext simulation calibrated to real tradecraft, run at a cadence that measures change, not a single day’s score.
Coach
A person who clicks gets context and a way back, not a public failure. Shame produces silence, and silence is the actual risk.
Measure
Human-risk analytics that show movement over time by cohort, so the question "is this working" has an answer.
Surface
Repeat patterns and outliers are reported to whoever owns risk in your organization, in a form they can act on, rather than left inside a training dashboard.
Coach, do not shame
The moment someone clicks is the only moment they are genuinely paying attention. Used to teach, it is the most effective minute in the whole program. Used to embarrass, it teaches something else entirely: that reporting a mistake is worse than hiding it, which is precisely the behavior that turns a contained incident into a breach.
- Immediate, private context at the point of failure
- No leaderboards of individuals, no public lists
- Reporting made easier than concealment
- Repeat exposure handled as a design problem, not a discipline one
Proof that exposure is falling
Most awareness programs report completion: how many people finished the module. That number goes up whether or not anyone changed. What matters is whether the same people keep failing, whether the risky cohorts are shrinking, and whether either trend holds after the campaign ends.
- Movement by cohort over time, not a completion percentage
- Repeat patterns identified and reported to whoever owns the risk
- Results your board and your auditor can both read