Yes. Cybersecurity culture can be measured with a survey, although a survey should usually be one part of the assessment rather than the whole assessment.
Surveys are well suited to measuring things people are in a position to report about themselves or their experience of the organization, including beliefs, attitudes, confidence, perceived norms, psychological safety, trust, leadership signals and the practical experience of security processes.
They are less useful for establishing what people actually do under pressure, why a particular event occurred, or whether a stated attitude consistently translates into behavior.
For Cybermaniacs, the useful question is therefore not whether surveys belong in cybersecurity culture assessment. They do. The more important question is what a survey can validly tell you, where its limits are, and what other evidence is needed to interpret the result well.
A culture survey is most useful when it targets constructs that are partly internal or experiential.
You can ask employees whether they believe senior leaders take security seriously, whether they feel confident escalating something unusual, whether they trust the security team, whether local managers support secure decision-making, whether colleagues generally follow expected practices, and whether employees feel comfortable admitting uncertainty or mistakes.
These questions matter because culture includes the beliefs, values and attitudes that influence behavior.
MIT Sloan's cybersecurity culture research defines organizational cybersecurity culture around the beliefs, values and attitudes that drive employee behavior to protect and defend the organization. Its work also places culture across leadership, group and individual levels rather than treating it as a purely individual awareness problem.
The 2025 rapid evidence review published in Computers & Security reached a similar conclusion after synthesizing 59 studies. The researchers identified multiple dimensions of cybersecurity culture, including employee attitudes, policy compliance, security education, behavior monitoring and top-management commitment. They also found that the research literature already uses a wide range of survey instruments, from very brief scales to multidimensional questionnaires with dozens of items.
Surveys are therefore appropriate instruments for questions that cannot be answered from telemetry alone.
A useful survey should focus on cultural conditions the organization actually needs to understand.
Depending on the assessment purpose, that may include:
The exact survey should depend on the question being investigated.
Organizations sometimes inherit their culture model from the questionnaire that came with the software. If the instrument contains twenty questions, it is easy to assume those twenty questions represent the most important dimensions of culture.
A better approach starts with the construct and then chooses the questions.
Our Guide on what a cybersecurity culture assessment should actually measure goes deeper into the cultural conditions that may be relevant and why they need to be interpreted in organizational context.
Many of the conditions that shape culture are not directly observable.
There is no system log showing whether an employee trusts the security team. A SIEM cannot tell you whether somebody believes raising a concern will damage their reputation with their manager. Identity data will not reveal whether a team has quietly concluded that a particular policy is unrealistic.
Those kinds of conditions have to be inferred or asked about.
NIST's Human-Centered Cybersecurity program explicitly frames cybersecurity around human needs, motivations, behaviors, abilities and limitations. It also treats security culture as an organization-wide set of values, attitudes and beliefs and emphasizes the importance of creating environments in which people feel empowered and engaged in cybersecurity.
A well-designed survey provides a scalable way to examine those experiences across a large workforce.
It can also surface patterns that operational data may not reveal. A company may discover, for example, that employees understand the reporting process but do not trust what happens after they use it. Another may find that senior leaders believe they strongly reinforce security while employees experience delivery pressure as the real priority.
Those are meaningful findings in their own right and often point to areas that deserve deeper investigation.
The most common problem is expecting the survey to answer questions it was never designed to answer.
If 87% of employees say they would report a suspicious request, that is evidence about reported intention, confidence or expected behavior.
It does not establish that 87% will report when the request arrives at 4:45 on a Friday, appears to come from the CFO, and concerns a transaction everyone wants completed before the weekend.
Context changes the decision.
Self-report measures can be affected by social desirability, recall, interpretation and the gap between what people believe they usually do and what happens when circumstances become difficult.
That does not make survey data weak. It means the result should be interpreted according to what was actually measured.
The 2025 evidence review is useful here because it did not identify one universally accepted culture instrument. Instead, it found multiple measurement approaches of very different lengths and dimensions, with varying amounts of psychometric evidence behind them.
That should make practitioners cautious about treating any off-the-shelf score as a complete representation of organizational culture.
Often, yes.
Interviews and focus groups add context that structured survey questions inevitably compress.
A survey might tell you that one business unit reports unusually low confidence in security processes. Interviews can help explain whether that reflects confusing policy, a difficult local manager, repeated bad experiences with the security team, technical friction, or something else entirely.
A 2024 study in Computers & Security specifically examined a mixed-methods approach to information security culture and found that combining quantitative surveys with semi-structured interviews produced more nuanced organizational insight than either method alone.
That result makes sense in practice.
Numbers are useful for identifying patterns and differences. Interviews are useful for understanding the conditions behind them.
Yes, when the behavioral evidence is relevant to the same question.
Suppose employees report very high confidence in recognizing and escalating suspicious activity.
If operational reporting data shows similarly strong escalation behavior, the two sources reinforce one another.
If actual reporting is very low, the discrepancy becomes more interesting than either result on its own.
Perhaps the survey captured knowledge rather than behavior. Perhaps employees are confident but the reporting process is inconvenient. Perhaps suspicious events are rare. Perhaps people escalate through channels the security team is not measuring. Perhaps the survey item itself needs refinement.
This is the logic behind triangulation.
Triangulation means using several relevant forms of evidence to build a more credible interpretation of the cultural condition. The purpose is not to force every source into agreement. In some cases, disagreement is exactly where the useful insight begins.
Our Guide on how to measure cybersecurity culture explains this measurement approach in more depth.
No.
Behavioral telemetry is valuable because it gives organizations evidence about what happened. That is a substantial improvement over relying entirely on stated attitudes or hypothetical scenarios.
Observed behavior still cannot always explain the conditions behind it.
Two people may follow the same security procedure for very different reasons. One may understand and value the control. Another may comply because the system physically prevents any alternative.
The transaction log records the same outcome.
The cultural implication may be very different.
Likewise, the absence of a behavior does not necessarily tell us why it did not occur. Low reporting could reflect low confidence, poor psychological safety, weak risk recognition, inconvenient tooling, ambiguous ownership or simply a lack of incidents to report.
Telemetry narrows the field of possible explanations. It does not remove the need for interpretation.
A culture survey primarily examines beliefs, perceptions, attitudes and the experienced organizational environment.
A behavioral assessment examines what people do or how they respond under particular conditions.
They can inform one another, especially when the organization is interested in the gap between what people believe and what happens in practice.
For example, a survey might identify low confidence challenging senior leaders. A scenario-based behavioral exercise could then examine how people actually respond to an unusual request apparently coming from an executive.
If both sources point in the same direction, confidence in the finding increases. If they disagree, the difference may reveal something important about the context, the measurement, or the behavior itself.
This is one reason Cybermaniacs separates security culture assessment from broader human risk assessment. Culture evidence can help explain why behavior emerges, while human risk analysis adds exposure, threat, access, business consequence and other forms of context.
Long enough to measure the relevant constructs well, but no longer than necessary.
There is no magic number.
The research literature reflects substantial variation. The 2025 evidence review identified instruments ranging from two-item scales to an 85-item Information Security Culture Assessment spanning multiple dimensions.
Longer instruments can support richer multidimensional analysis, but they increase respondent burden and do not automatically produce better insight. Shorter surveys are easier to deploy and repeat, although reducing a complex construct too aggressively can leave important dimensions unmeasured.
The right length depends on purpose.
A deep baseline assessment intended to understand culture across several dimensions may justify a more substantial instrument. A pulse survey checking whether one specific cultural condition is shifting should probably be much shorter.
Employees are generally willing to help.
That goodwill should not be mistaken for enthusiasm for a 94-question journey of self-discovery before lunch.
Survey cadence should follow the question being asked and the rate at which the underlying condition is likely to change.
A deeper culture baseline may be conducted periodically, perhaps annually or as part of a wider diagnostic cycle. Shorter pulse surveys can be used more frequently when the organization is monitoring a specific intervention or cultural condition.
Significant organizational events may also justify reassessment.
Mergers, acquisitions, leadership changes, restructuring, major incidents, rapid technology adoption and significant AI deployment can all change employees' experience of security.
The useful principle is to measure when fresh evidence can change a decision.
Repeatedly asking employees whether they trust you without acting on the previous answer can eventually become a cultural finding in its own right.
Start by interpreting them before deciding on the intervention.
If a survey identifies low confidence, investigate what is driving it.
If employees report poor psychological safety, examine management practices and previous reporting experiences.
If policy friction is high, look at the workflow.
If leadership scores are weak, understand whether the issue lies in communication, behavior, incentives or a gap between executive intent and local management practice.
The intervention should follow the diagnosis.
One of the main advantages of measuring culture properly is that it gives the organization more options than assuming every human-related problem requires another awareness campaign.
Yes, provided the organization understands what the score represents.
A summary score can be useful for communicating results, tracking movement or comparing relevant populations. Multidimensional sub-scores may also help show where cultural conditions differ.
The score still needs an interpretable foundation.
What constructs are included? How were they measured? Are the measures reliable? Which populations responded? What context might affect the result? What conclusions can reasonably be drawn?
A score becomes less useful when its apparent precision exceeds the evidence behind it.
A company's cybersecurity culture is unlikely to become fundamentally more understandable because somebody calculated it to one decimal place.
Benchmarking can be useful, but it needs careful interpretation.
External benchmarks may help an organization understand whether particular findings are unusual. Internal benchmarking across teams, roles or time periods can also reveal meaningful variation.
The difficulty is that organizations differ.
Industry, threat environment, workforce composition, geography, operating model, leadership, technology and risk exposure all affect the context in which culture develops.
A score of 74 in one organization is not automatically better or worse than a 71 somewhere else simply because 74 is the larger number.
Benchmarks can provide orientation. They should not substitute for understanding the organization being assessed.
A useful survey should have a clear conceptual basis and measure constructs that matter to the organization's question.
It should use understandable language, avoid leading respondents toward obviously desirable answers, and distinguish between concepts such as knowledge, confidence, perceived norms and actual experience.
Where possible, the underlying constructs and scales should have research support or evidence of reliability.
The survey should also produce results that can be interpreted and acted upon.
A beautifully validated questionnaire that creates no useful decision for the organization has limited practical value.
NIST's work on the gap between human-centered cybersecurity research and practice is relevant here. A 2024 study of 152 cybersecurity practitioners found that practitioners value human-centered research but experience challenges applying research insights in operational environments.
That is a useful reminder for culture assessment.
Academic rigor matters because it improves the quality of the evidence. Practical usefulness matters because the evidence eventually has to support a decision.
A strong survey-based culture assessment begins with a defined assessment question and a clear idea of what the organization is trying to understand. That sounds basic, but it is one of the easiest places for culture work to drift. If the starting point is simply “we should run a culture survey,” the organization can end up collecting a large amount of technically valid data without being much closer to a useful diagnosis.
The survey should therefore measure identifiable cultural constructs that relate directly to the problem or decision at hand. Where appropriate, those constructs should be grounded in established research or validated measurement approaches. Just as importantly, the assessment should distinguish between different kinds of evidence. Perception, confidence, norms, trust, and lived experience are not the same thing as observed behavior, and a well-designed culture assessment should not pretend they are.
Sampling and segmentation also matter. Culture is rarely uniform across an enterprise, so it can be useful to understand how experience differs by role, geography, business unit, tenure, manager, or operating environment. That does not mean every difference should become its own finding. Small samples can create noise, and over-segmentation can make patterns appear more meaningful than they really are. The goal is to surface differences that genuinely help explain how security is experienced in different parts of the organization.
A good assessment also makes room for contradictions. If one team reports high trust in the security function while interviews suggest frustration and avoidance, that discrepancy deserves attention. If employees say they feel confident escalating issues but operational evidence shows low reporting, the inconsistency may be more informative than either measure on its own. Culture measurement becomes stronger when disagreement is treated as a clue rather than a nuisance to be averaged away.
The survey itself should also be honest about what self-report evidence can establish. Respondents can tell you how they perceive leadership, whether they feel confident, how they experience a process, whether they trust a team, or whether certain behaviors feel normal in their environment. Those are important cultural signals, but they still sit inside a wider interpretive problem.
The quality of the assessment therefore depends on more than the questionnaire. It depends on whether the organization can connect the findings to a credible explanation of what is happening, where the issue matters most, and what might actually need to change.
A survey has done its job when it gives leaders access to evidence they could not reasonably get from technical systems alone and places that evidence in enough context to support a meaningful decision.
The expansion of behavioral analytics, identity data and human-risk telemetry is giving security teams extraordinary visibility into what people do. That is a major improvement over the era when most human-risk reporting consisted of training completion and a phishing percentage.
There are still important questions those systems cannot answer.
Does an employee believe their manager will support them if they stop a process because something feels wrong? Does a new hire think asking the security team for help is encouraged or embarrassing? Does a business unit believe the formal policy reflects how the work is actually done? Do employees trust that admitting a mistake early will lead to help rather than blame? Does a team believe security is a genuine part of good work, or simply another approval hurdle to get through?
Questions like these live inside people's experience of the organization.
Some of that experience will eventually show up in behavior, but by the time it does, the organization may only be seeing the outcome. A pattern of low reporting might reflect poor psychological safety, lack of confidence, an inconvenient reporting route, weak local leadership, fear of blame, or some combination of those conditions. The event data can show that reporting is low. It usually cannot tell you which explanation is correct.
That is where surveys remain useful.
A well-designed questionnaire can surface beliefs and perceptions before they become visible in incident statistics. It can reveal a gap between leadership intent and employee experience, expose friction in a process that appears perfectly reasonable on paper, or show that different parts of the organization are experiencing security in fundamentally different ways.
The sophistication lies in knowing what to ask, interpreting the answers carefully, and connecting that evidence with the rest of what the organization already knows.
A survey should therefore sit alongside behavioral data, security telemetry, interviews, and organizational context rather than competing with them. Each source contributes something different to the diagnosis. The survey's value is that it can make visible the things that technical systems are not designed to observe.
That is why surveys remain an important part of cybersecurity culture measurement. Some of the conditions shaping human behavior appear in systems and events. Others live in how people understand and experience the organization around them.
If we want to understand culture, we need access to both.
A culture survey should lead to diagnosis before it leads to intervention.
If the survey identifies low confidence, the organization should understand what is driving it before deciding how to respond. The issue may be knowledge, but it could just as easily be lack of practice, weak managerial support, poor process design, or uncertainty about where responsibility sits.
If employees report low psychological safety, the answer may have very little to do with awareness content. Management behavior, escalation experience, perceived blame, and local leadership may matter much more.
If policy friction is high, the organization should examine the workflow itself. Employees may know exactly what the policy requires and still avoid it because the process is slow, unclear, or difficult to reconcile with legitimate work.
If leadership scores are weak, the useful question is what sits behind that finding. Employees may not see leaders talk about security. They may see leaders talk about it while behaving differently under pressure. Local managers may be sending signals that override executive messaging. Each of those conditions points toward a different response.
This is one of the biggest advantages of measuring culture properly. It gives the organization more options than assuming every human-related problem needs another awareness campaign.
The survey should help narrow the problem, identify where deeper investigation is needed, and support a response that matches the condition actually found.
Yes, provided the organization understands exactly what the score represents.
A summary score can be useful for communicating results, tracking movement, comparing relevant populations, or helping leaders see where attention may be needed. Multidimensional sub-scores can also be useful when the underlying constructs are clearly defined and the organization wants to understand differences across areas such as leadership, confidence, norms, trust, or friction.
The difficulty begins when the score becomes more authoritative than the evidence underneath it.
What constructs are included? How were they measured? Are the scales reliable? Which populations responded? How representative is the sample? What assumptions sit behind the weighting? What context might affect the result? What conclusions can reasonably be drawn from a change in the number?
Those questions matter because a score can create a strong illusion of certainty.
A company with a culture score of 74.3 has not necessarily become meaningfully more understandable than a company with a score of 72.8. The decimal places may be mathematically correct and still tell leaders very little about what needs to change.
Scores are most useful when they summarize evidence without hiding it.
The point is to make interpretation easier, not to compress the culture so completely that the underlying conditions disappear.
Benchmarking can be useful, but it needs careful interpretation.
External benchmarks may help an organization understand whether particular findings are unusual in relation to peers or broader populations. Internal benchmarking across teams, roles, or time periods can also reveal meaningful variation.
The challenge is that organizations differ in ways that matter.
Industry, threat environment, workforce composition, geography, operating model, leadership, technology, regulatory pressure, and risk exposure all shape the context in which culture develops.
A score of 74 in one organization is not automatically better or worse than a 71 somewhere else simply because 74 is the larger number.
External benchmarks are useful when they provide orientation. Internal benchmarks can be even more useful when they reveal where one part of the organization is experiencing security differently from another.
The benchmark should help leaders ask better questions.
It should not replace understanding the organization being assessed.
A useful survey should have a clear conceptual basis and measure constructs that matter to the organization's question.
The language should be understandable to the people completing it. Questions should avoid obvious leading language and should distinguish between concepts such as knowledge, confidence, perceived norms, trust, and actual experience.
Where possible, the constructs and scales should have research support or evidence of reliability. That gives the organization greater confidence that the survey is measuring something coherent rather than merely collecting reactions to a set of loosely related statements.
The design also needs to work in practice.
A beautifully validated questionnaire that employees do not complete, cannot understand, or that creates no useful decision for the organization has limited operational value.
NIST's work on the gap between human-centered cybersecurity research and practice is relevant here. A 2024 study of 152 cybersecurity practitioners found that practitioners value human-centered research but experience challenges applying research insights in operational environments.
That tension matters for culture assessment.
Academic rigor improves the quality of the evidence. Practical usability determines whether the evidence can actually support a real-world decision.
A good instrument needs both.
Survey results should not automatically be collapsed into one enterprise average.
Large organizations often contain multiple subcultures. An engineering team, manufacturing site, corporate function, acquired business, regional office, and executive population may all operate under the same policies while experiencing security very differently.
That variation can be meaningful.
One team may report high confidence and strong local leadership but significant workflow friction. Another may find security processes easy to use while employees remain reluctant to speak up. A third may perform well overall but show a persistent gap between manager perception and employee experience.
Those differences can help the organization understand where the same enterprise policy is producing different cultural outcomes.
Segmentation still needs to be handled carefully. Small samples, demographic sensitivity, and weak statistical power can all create misleading patterns. The point is not to turn every subgroup into a separate culture diagnosis.
The point is to preserve enough variation to avoid averaging away the parts of the organization where something important is happening.
Investigate.
A mismatch between what people report and what they do can be one of the most useful findings in culture work.
Employees may say they feel highly confident escalating suspicious activity while operational reporting remains low. That could mean the survey is capturing knowledge rather than real-world confidence. It could mean the reporting process is inconvenient. It could mean employees use channels the security team does not capture. It could mean relevant events are uncommon.
The disagreement narrows the diagnostic problem.
Similarly, employees may report that security is strongly valued while behavioral evidence shows recurring workarounds. The issue may be local pressure, poor process design, or the difference between supporting security in principle and following it when work becomes difficult.
Culture measurement should not be designed to make every data source agree.
The goal is to build a credible explanation from the evidence available.
That often requires some curiosity about the places where the evidence does not line up neatly.
The expansion of behavioral analytics, identity data and human-risk telemetry is giving security teams extraordinary visibility into what people do. That visibility is valuable, but it is not the same thing as understanding the conditions that shaped the behavior.
There are still important questions those systems cannot answer.
Does an employee believe their manager will support them if they stop a process because something feels wrong? Does a new hire think asking the security team for help is encouraged or embarrassing? Does a business unit believe the formal policy reflects how the work actually gets done? Do employees trust that admitting a mistake early will lead to help rather than blame?
If the organization wants answers to those questions, sometimes the most sophisticated tool available is still a well-designed question asked of the person experiencing the work.
The sophistication lies in what happens afterward.
The answer should be interpreted in context, compared with other evidence where useful, and connected to the risk or organizational decision the assessment was intended to support.
That is why surveys remain an important part of cybersecurity culture measurement. Some of the conditions shaping human behavior are visible in systems and events. Others exist in how people understand and experience the organization around them.
A serious culture assessment needs access to both.
Cybermaniacs has been researching and writing about cybersecurity culture for years, and this Guide sits within a broader body of work on how culture connects to Human Risk Management.
If you are developing or reassessing your own approach, our Guide on how to measure cybersecurity culture looks at how perception, qualitative research, behavioral evidence, and organizational context can be combined.
What Should a Cybersecurity Culture Assessment Actually Measure? goes deeper into the organizational conditions a meaningful culture assessment should examine, including leadership, norms, confidence, psychological safety, and security experience.
We also explore the boundary between culture and broader risk in Security Culture Assessment vs. Human Risk Assessment: What's the Difference?, and our earlier article Measuring Cyber Security Culture: NCSC-Aligned Metrics That Actually Work looks at practical culture metrics and the limits of traditional awareness measures.
For a wider strategic view, A CISO's Guide to Cybersecurity Culture examines the relationship between culture, leadership, and modern Human Risk Management.
Taken together, the principle is consistent: cybersecurity culture cannot be reduced to one survey, one score, or one stream of behavioral data. It becomes useful when organizations understand the conditions shaping behavior well enough to make better decisions about risk.
Yes. Surveys are useful for measuring beliefs, attitudes, perceived norms, confidence, psychological safety, trust, and employees' experience of security. They are generally stronger when interpreted alongside qualitative, behavioral, or organizational evidence.
A culture survey may examine leadership, shared norms, risk perception, self-efficacy, psychological safety, trust, organizational support, accountability, policy experience, workflow friction, and learning. The dimensions should reflect the purpose of the assessment rather than being selected simply because they are easy to measure.
They can be, particularly when they use clearly defined and evidence-based constructs. Reliability also depends on survey design, question wording, sampling, response quality, and how the findings are interpreted within the organization.
A survey can measure reported behavior, intentions, or confidence, but self-report evidence should not automatically be treated as proof of actual behavior. Where relevant behavioral or operational evidence exists, it can be compared with survey findings to strengthen interpretation.
Anonymous or confidential approaches can help respondents answer sensitive questions more openly, particularly when the survey examines trust, psychological safety, management behavior, or willingness to report mistakes. The right approach depends on the assessment design and organizational context.
Deep culture surveys are usually periodic, while shorter pulse surveys may be used more frequently to monitor a specific condition or intervention. Significant organizational changes such as acquisitions, leadership transitions, major incidents, or large-scale technology adoption can also justify reassessment.
There is no universal ideal length. The survey should be long enough to measure the relevant constructs reliably without creating unnecessary respondent burden. A deep diagnostic assessment may require more items, while a targeted pulse survey should usually be much shorter.
Benchmarking can provide useful context, but it should be interpreted carefully. Industry, workforce, operating environment, leadership, technology, and organizational structure can all influence culture, so benchmark comparisons should inform interpretation rather than replace it.