How to prove your programme is working, not just running
1. The Foundations
The first instalment in the Metrics & Measurement pillar. We look at why completion rates and click rates alone won't tell you whether your programme is working, what to measure instead, and how to start building a measurement approach that connects what you do to what actually changes.
2. Building A Security Culture Baseline
Before you can show improvement, you need to know where things stand today. This video walks through how to build a meaningful baseline for your security culture, what data points actually matter, and how to avoid the common trap of measuring what's easy instead of what's useful.
Leading vs Lagging Indicators
Most security awareness reporting is backward-looking: how many people clicked, how many completed training. That tells you what happened, not whether things are getting better. This video breaks down the difference between leading and lagging indicators and how to use both to build a picture of where your programme is actually heading.
Culture Surveys & Behavior Studies
Click rates and completion data tell you about behavior, but they don't tell you why. Culture surveys and behavior studies give you the other half of the picture: how people feel about security, whether they see it as relevant, and where the gaps are between what your programme assumes and what's actually landing.
Metrics Dashboards That Matter
You've got phishing data in one tool, training completions in another, survey results in a spreadsheet. This video walks through how to pull it together into a single dashboard that tells a coherent story, what belongs on it, what doesn't, and how to design it so it's useful for you and the people you report to.
How To Present Data To Different Audiences
The data that helps you run your programme is not the data that gets you support for it. This video covers how to tailor what you present depending on who you're talking to, from operational detail for your own team to the strategic narrative that lands with senior leadership.
Getting Your Peers on Your Side
The data that would make your programme smarter usually exists somewhere in the organisation. The problem is getting access to it. This video covers how to approach technical teams like the SOC, IT and the help desk, not with a data request but with a conversation about shared problems. It walks through how to run a discovery conversation, how to frame the ask, and how to build the kind of working relationships that mean you don't have to fight for access every time.
Turning Data into a Programme Narrative
A dashboard full of metrics is not a story. This video covers how to take what your data is telling you and turn it into a narrative that explains where your programme has been, where it's going, and what needs to happen next. The difference between a programme that gets funded and one that gets forgotten often comes down to how well you tell that story.
Making Your Data Speak the Language of Risk
You've got the metrics, the trends, the survey results. But when you present them to senior leadership, they land with a polite nod and nothing else. The problem isn't the data, it's the translation. This video covers how to connect what your programme measures to what leadership is already worried about, how to lead with risk rather than activity, and how to turn a presentation into a conversation that actually moves things forward.