Data tells you what happened. A narrative tells people what it means and why it matters.
Most awareness professionals are pretty good at the data part. They are collecting numbers, tracking trends, and building dashboards. Where, in my experience, this starts to fail is when it comes to turning all of that into something that actually moves people.
Decisions in organisations are not usually made because someone saw a compelling spreadsheet. They are made because someone told a convincing story, backed up by evidence. Your data is the evidence but this video is about the story.
Why narrative matters
People remember stories. People don’t remember data points.
A risk committee that hears "our phishing click rate is twelve percent" will hear that and move on. A committee that hears "we have reduced credential-harvesting susceptibility in our highest-risk teams by forty percent over two years, and here is what that means in terms of the attack surface we have closed" will remember it.
Narrative gives your data a shape. You have a beginning, a middle, and most importantly, a direction. It also answers the question that numbers alone never answer: so what?
The structure of a programme narrative
There are four stages and they always run in the same order.
Where were we - Establish the baseline. What did the situation look like before you started? what were the risks? What were the gaps you identified when you came in or when the programme was reset?
What did we do - This shouldn’t be a list of everything you ran but more the strategic choices you made and why. What were the problems you were trying to solve and how did you decide to address them?
What changed - This is all about the evidence. Here you can get into your behaviour signals, culture trends, and your risk indicators. Here’s where you show the movement. Not just the number but the direction of travel and what it took to get there.
Where are we now and what is next - This is your current state, your remaining risks, and your forward plan. This is also where you show you are not just reporting history but that you are actively running something.
This four-part structure works for annual reviews. It also works for board presentations and budget conversations. I’ve even used it when briefing a new stakeholder. It scales well because the logic is the same, regardless of the audience.
Connecting your data to what the organisation already cares about
The most powerful narratives don’t stand alone but connect to something that your organisation is already worried about.
If you’ve had a credential-based incident, your phishing susceptibility data carries real weight. If your sector is under regulatory pressure, your culture survey results showing improved security ownership become a compliance story as much as an awareness one.
Your data doesn’t live in isolation. You should find the connection to the business context and make it connection clear. That is the difference between data that gets filed away and data that gets acted on.
What to do with imperfect data
Your data will never, ever, be perfect. Gaps, inconsistencies, and things you cannot measure directly are a fixture of every awareness function I have seen. It is perfectly normal and it is fine.
Don’t hide the limitations. Acknowledge them briefly, explain what you are doing to address them, and then move on. That is more credible than pretending you have certainty you don’t have. Decision-makers will know and understand that measurement is hard. Being upfront about what you cannot measure yet doesn’t undermine your case, In fact, it usually strengthens it.
And lastly, a perfect dataset isn’t a necessity. A consistent trend, mapped across three or four good metrics is a story. You don’t need fifteen different metrics all pointing in the same direction. You need a few that you trust, that you have tracked over time, and that you can explain clearly and confidently.
This takes work
A good programme narrative will never write itself. You should draft it, read it out loud, and ask whether the logic holds. Does the evidence actually support the conclusions you are drawing?
Then get someone outside the team to look at it before you present it. Not for the data, but for the story. A fresh pair of eyes will likely catch gaps in the logic that you are too close to see.
Closing
The data is the foundation. The narrative is what gets you the resources, the support, and the credibility to do the work properly.
If you are sitting on good data that is not changing anything, the missing piece is probably the story. Spend as much time on how you tell it as you do on collecting it.
