Cybersecurity culture is best measured by combining perception, qualitative, behavioral and organizational evidence.
Surveys can help assess beliefs, attitudes, confidence, norms and employees' experience of security. Interviews and focus groups add context that structured questions may miss. Behavioral and operational evidence shows how people act when security decisions arise in real work, while organizational evidence helps explain the leadership, process and working conditions surrounding those decisions.
No single source is sufficient because culture is partly experienced, partly expressed and partly revealed through patterns over time. At Cybermaniacs, we therefore approach culture measurement as an exercise in understanding the environment that shapes behavior, where that environment differs across the organization, and which cultural conditions are relevant to the risks the organization is trying to manage.
The aim is not exhaustive measurement. It is enough reliable evidence to support a useful interpretation and a better decision.
What Does It Mean to Measure Cybersecurity Culture?
Measuring cybersecurity culture means assessing the shared values, attitudes, beliefs, norms and organizational conditions that influence how people behave around cybersecurity.
That definition gives us an important clue about the measurement approach.
MIT Sloan's research on organizational cybersecurity culture defines culture around the beliefs, values and attitudes that drive employee behavior. It draws on the wider organizational-culture tradition, including Edgar Schein's distinction between underlying beliefs, espoused values and visible artifacts or behaviors.
If culture exists partly beneath the behavior we can see, behavioral evidence can only ever reveal part of the picture.
NIST's Human-Centered Cybersecurity program makes a related distinction. It describes security culture in terms of organization-wide values, attitudes and beliefs while also examining human-system interaction, psychology, workflow, friction, learning and the wider relationship between people, process and technology.
A major 2025 evidence review published in Computers & Security reached a similar conclusion. After reviewing 1,768 records and synthesizing 59 eligible studies, the researchers found that cybersecurity culture needs to be treated as a management and organizational issue as well as a technical one, with top-management involvement, organizational support and the conditions surrounding desired employee behavior all playing important roles. Read the research in Computers & Security.
Those findings make culture an awkward fit for a conventional dashboard. The things that matter are distributed across systems, teams and experiences, and some of them only become visible when different forms of evidence are interpreted together.
Why Can't You Measure Security Culture With One Metric?
Different measurements illuminate different parts of the problem.
Suppose an organization has an excellent phishing-reporting rate. That is useful behavioral evidence, but the number alone cannot tell you whether employees report because they feel responsible for protecting the organization, because their managers reinforce the behavior, because the latest campaign made reporting unusually salient, or because the mail client has made the process exceptionally easy.
Those conditions become more important when the environment changes. If the reporting button disappears, the threat shifts from obvious phishing to executive impersonation, or an employee has to question a request from somebody three levels above them, the cultural conditions beneath the original behavior begin to matter.
This is why Cybermaniacs distinguishes between evidence of behavior and evidence about the environment shaping that behavior. Both can be useful, but they contribute different kinds of information.
There is also a practical danger in insisting that every important cultural condition must have a directly observable metric. Organizations then gravitate toward whatever their existing systems can count, and the available dashboard starts determining the questions worth asking.
That is a poor way to build a measurement model.
Our broader guide to how to measure human cyber risk explores the same problem from the wider Human Risk Management perspective: events and metrics only become useful when they can be interpreted as meaningful signals, patterns and risk conditions.
What Evidence Should You Use to Measure Cybersecurity Culture?
A strong culture assessment usually combines several forms of evidence. The exact mix will vary according to the organization and the question being investigated, but four broad evidence families are particularly useful.
1. Perception and Attitudinal Evidence
Some aspects of culture have to be asked about because they exist partly in people's perception of the organization.
Do employees believe senior leaders take security seriously? Do they feel confident recognizing when something needs escalation? Do they believe their manager would support them if following a security process delayed the work? Do people trust the security function? Do they believe colleagues generally follow the expected practices? Do employees feel safe admitting a mistake?
These are not incidental opinions. Perceptions shape decisions, and surveys are therefore entirely legitimate when they are designed to measure constructs that genuinely require self-report.
The important issue is whether the survey is measuring something respondents are in a position to know and whether the resulting evidence is interpreted with appropriate care.
2. Qualitative Evidence
Interviews, focus groups and open-ended responses help explain the organizational story underneath structured measurements.
They allow researchers to ask follow-up questions, understand how employees interpret policies, identify local norms and hear the language people actually use when describing security. That matters because organizations have an impressive ability to make very different realities look identical inside a five-point scale.
Imagine two teams both give a security process an average score of three out of five. In one team, employees think the process is sensible but occasionally slow. In the other, everyone has quietly stopped using it.
Same score, very different Tuesday afternoon.
Qualitative evidence is especially valuable when there are surprising differences between populations, contradictory findings or patterns that cannot be understood adequately from quantitative data alone.
3. Behavioral and Operational Evidence
Culture assessment should also look at what happens in practice.
Behavioral evidence can help determine whether the patterns reported in surveys or interviews are visible in real work. Depending on the question, that might include reporting behavior, security-event patterns, use of formal processes, escalation behavior, recurring workarounds or other forms of operational evidence.
The evidence still needs to match the construct being assessed.
Training completion tells us that somebody completed training. Reporting behavior may be relevant to a question about willingness to escalate. Phishing data may contribute to a question about how people respond to a particular class of social-engineering threat.
Problems arise when every available metric is treated as evidence for every cultural question.
Measurement improves when the evidence is selected because it is relevant, rather than because the platform happens to produce it.
4. Organizational and Contextual Evidence
Culture exists inside an operating environment.
Leadership structures, incentives, policies, technologies, workflows, role expectations, organizational change and local management practices all influence how security is experienced.
NIST's Human-Centered Cybersecurity work is particularly helpful here because it emphasizes designing security around real human needs and workflows, reducing friction and creating security that works in practice rather than merely in theory.
If employees repeatedly bypass a process, for example, the organization needs to understand the conditions around that behavior. The local norm may be that rules are optional. Managers may quietly encourage the workaround. Employees may not understand the risk. The process may simply be unusable.
Those explanations point toward very different interventions.
Our Guide, What Should a Cybersecurity Culture Assessment Actually Measure?, goes deeper into the organizational conditions worth examining, including leadership, norms, confidence, psychological safety, security experience and workflow friction.
What Should a Cybersecurity Culture Survey Measure?
A cybersecurity culture survey should focus on cultural constructs that people are reasonably able to report about themselves or their experience of the organization.
Depending on the assessment purpose, those might include:
- perceived leadership commitment to security;
- shared security norms;
- risk perception and personal relevance;
- confidence and self-efficacy;
- psychological safety and willingness to speak up;
- trust in security processes and teams;
- perceived organizational support;
- accountability and ownership;
- policy and control experience;
- perceived friction;
- learning and adaptability; and
- employees' experience of how security operates in real work.
The list is not intended as a universal Cybermaniacs assessment instrument. Different organizations require different constructs, questions, validation approaches and diagnostic logic.
The useful principle is simpler: define the cultural condition you need to understand, then select an instrument capable of measuring it with reasonable validity.
A twenty-question annual survey chosen because those were the questions included with the software subscription may still generate data. That does not guarantee the data will answer a useful question.
Should You Measure Security Culture With a Survey Alone?
Usually not.
Surveys are valuable because many of the things we care about cannot be directly observed. You cannot pull psychological safety from a SIEM, and there is no API call for whether employees believe their manager genuinely supports escalation.
We should perhaps be grateful for that. Cybersecurity already has enough APIs.
Self-report evidence still has limitations. People may respond in socially desirable ways, interpret questions differently, or describe what they believe they usually do rather than what happens under pressure. A survey also captures perspective at a particular point in time.
These limitations are manageable when the evidence is treated for what it is. The risk comes when a survey score is allowed to stand in for the culture as a whole.
A stronger approach compares perception with other relevant evidence and treats differences between sources as something to investigate.
What Is Triangulation in Cybersecurity Culture Measurement?
Triangulation means examining a cultural condition using more than one relevant source of evidence.
Suppose employees report high confidence in escalating suspicious activity, while operational data shows that the same population rarely reports anything.
That discrepancy is useful because it opens several possible explanations. Employees may understand the expected answer on the survey but behave differently under pressure. Reporting opportunities may genuinely be rare. The reporting mechanism may be inconvenient. People may be using channels the security team is not measuring. The survey item itself may need work.
Another organization might discover that senior leaders rate their own security leadership highly while employees report that delivery pressure routinely overrides security expectations.
Again, the difference between the evidence sources is informative.
Good measurement is not a hunt for perfect agreement. Some of the most useful findings emerge from the places where evidence diverges.
Can Behavioral Data Measure Cybersecurity Culture?
Behavioral data can contribute to culture measurement, but it cannot explain the culture by itself.
Consider two employees who both follow a security approval process. One understands why the control exists, trusts the process and sees compliance as part of responsible work. The other follows it because the system gives them no alternative.
From the transaction log, they may look identical.
Remove the enforcement mechanism and the difference becomes much more interesting.
MIT's organizational cybersecurity culture research is useful here because it treats beliefs, values and attitudes as drivers of behavior while recognizing that managerial mechanisms and external influences shape those conditions.
Behavioral evidence therefore helps us see what happened. Culture assessment helps us interpret the environment in which that behavior became likely.
What About Phishing Metrics and Training Completion?
They can contribute evidence when they are relevant to the question being asked.
Phishing simulations may reveal useful behavioral patterns. Reporting rates may help explore whether employees act on suspicious communications. Training data can show whether people have been exposed to particular learning or whether participation varies between populations.
The problem begins when those measures are treated as culture simply because they involve employees.
A training completion rate cannot tell us whether a manager makes secure behavior possible under deadline pressure. A phishing click does not tell us whether employees trust the security function, feel safe reporting mistakes or work in teams where bypassing controls has become normal.
Cybermaniacs has written about this distinction for several years because culture measurement becomes much weaker when the output of the awareness platform quietly becomes the definition of culture.
Our deeper article, Measuring Cyber Security Culture: NCSC-Aligned Metrics That Actually Work, explores practical culture metrics across perception and climate, behavior, and the operational structures surrounding employees.
How Do You Measure Security Culture Across Different Teams?
Do not assume the enterprise has one perfectly uniform security culture.
Most organizations contain subcultures. A corporate function, engineering team, manufacturing site, acquired business and regional sales organization may operate under the same policies while experiencing security very differently.
Leadership varies. Work varies. Technology varies. Pressure varies. Local norms vary.
That makes enterprise averages useful only up to a point.
An overall culture score can look perfectly respectable while hiding a team where people are afraid to report mistakes or a high-risk population where working around security controls has become normal practice.
Measurement should therefore allow meaningful differences between populations to become visible where the sample and methodology support it.
The objective is not to produce a league table of which department has the nicest culture. It is to identify differences that matter for interpretation and action.
How Do You Know Whether Security Culture Is Improving?
This is more difficult than simply repeating the same survey every year.
A change in a culture score may indicate improvement, but it may also reflect workforce changes, response patterns, current events, question interpretation or other conditions.
Confidence increases when several relevant forms of evidence move in a consistent direction.
Suppose an assessment finds that employees lack confidence challenging unusual requests from senior colleagues. Management responds with clearer executive sponsorship, changes to verification processes, targeted practice and explicit reinforcement from senior leaders.
Six months later, survey evidence shows increased confidence. Interviews suggest employees feel more permission to challenge. Escalation evidence shows more questions being raised in relevant scenarios.
Taken together, those findings support a more credible interpretation that the underlying condition has changed.
The result still does not require a culture score with three decimal places.
Very few worthwhile management problems do.
How Often Should You Measure Cybersecurity Culture?
Different evidence operates on different clocks.
Threat signals can change continuously. Security events may require daily monitoring. Behavioral patterns might be reviewed weekly or monthly. Culture generally moves more slowly, although significant organizational events can alter it quickly.
That means a periodic deeper culture assessment can coexist with lighter pulse measures, targeted diagnostics and continuous operational evidence.
Material events may also justify reassessment. A merger can combine very different organizational norms overnight. A major incident may change trust and risk perception. Leadership changes can alter local expectations. Rapid AI adoption can reshape roles, authority and working practices faster than an existing culture model anticipated.
The appropriate cadence should follow the decision need rather than a generic calendar.
Culture is not a Fitbit. There is little value in taking its pulse every five minutes simply because the platform can.
What Should You Do When Culture Measures Disagree?
Investigate.
Contradictions are often some of the most useful findings in culture work.
Employees may say security is highly valued while also reporting that deadlines routinely override controls. Leaders may believe employees feel safe admitting mistakes while employees describe the opposite. A team may report high confidence while behavioral evidence suggests repeated hesitation.
Those gaps can reveal differences between stated culture and experienced culture, between knowledge and action, or between leadership intent and operational reality.
They can also expose flaws in the measurement itself.
The purpose of triangulation is to determine whether the combined evidence supports a credible interpretation. That requires judgment and enough understanding of the organization to know what the evidence may actually mean.
Technology can help collect, organize and compare the evidence at scale. Interpretation still depends on understanding the environment in which it was produced.
How Is Cybersecurity Culture Measurement Different From Human Risk Measurement?
Cybersecurity culture measurement focuses on the organizational conditions shaping security behavior.
Human risk measurement is broader. It may connect culture evidence with competency, psychology, behavioral patterns, identity and access, threat exposure, security events, organizational context and potential consequence.
For example, a culture assessment may identify that employees in one population have unusually low confidence challenging senior colleagues. That finding becomes more significant when human risk analysis establishes that the same population authorizes high-value financial transactions and is being actively targeted by executive impersonation attacks.
The culture finding helps explain the condition. Human risk analysis establishes its significance in context.
We explore that distinction directly in Security Culture Assessment vs. Human Risk Assessment: What's the Difference?, while our broader guide to measuring human cyber risk explains how multiple forms of evidence can be connected into meaningful risk signals and patterns.
What Does Good Cybersecurity Culture Measurement Look Like?
Good culture measurement should help an organization understand something it can use.
A credible approach will usually:
- start with a defined question or assessment purpose;
- measure cultural constructs rather than whatever employee data happens to be available;
- use validated or evidence-based constructs where appropriate;
- combine perception, qualitative, behavioral and organizational evidence;
- distinguish observed behavior from the cultural conditions that may influence it;
- allow meaningful differences between populations to become visible;
- preserve enough organizational context to interpret the findings;
- acknowledge uncertainty and contradictory evidence;
- create a baseline that can support meaningful comparison over time; and
- lead to diagnosis and action rather than stopping at a score.
The output may include quantitative measures and summary scores. Those can be useful communication tools as long as the organization retains visibility into the evidence and assumptions underneath them.
A culture assessment has done its job when leaders understand the conditions shaping security behavior well enough to make a better decision.
What Should Happen After You Measure Security Culture?
Measurement should lead to diagnosis before intervention.
If employees lack knowledge, learning may be appropriate. If they understand the expected behavior but lack confidence, the organization may need to build capability and self-efficacy. If people fear reporting mistakes, leadership behavior and psychological safety may matter more. If teams routinely work around a security process because it prevents them from doing legitimate work, fixing the process may achieve considerably more than reminding everyone of the policy again.
The assessment should help distinguish between those situations.
This is why Cybermaniacs treats culture measurement as part of a broader Human Risk Management capability rather than as a standalone survey exercise. Our Human Risk Management Capability Map shows how understanding and diagnosing organizational conditions connects with influencing behavior and culture, linking evidence and context, and measuring risk and change.
The practical question is what the organization has learned about how work actually happens and what should change as a result.
If the measurement process cannot help answer that, it is worth examining whether the organization is measuring the right things.
Measuring Culture Means Understanding the Organization Behind the Behavior
Organizations now have more behavioral and security data about their workforces than at any point in the history of cybersecurity.
That creates exciting possibilities, but it also makes it easier to confuse visibility with understanding.
Culture provides a way to examine what people believe, what teams normalize, how leaders influence behavior, where employees feel confident, where they remain silent and whether the organization's systems make secure behavior realistic in the first place.
Strong culture measurement combines those human and organizational perspectives with evidence about what actually happens. Surveys, interviews, behavioral evidence and organizational context each contribute different parts of the picture, and their value increases when they are interpreted together.
The work is more demanding than adding another gauge to the dashboard.
It is also more likely to tell you something worth acting on.
Continue Exploring Cybersecurity Culture
Cybermaniacs has been researching, measuring and writing about cybersecurity culture for years. If you are building or reassessing your own approach, these pieces explore different parts of the problem:
- What Should a Cybersecurity Culture Assessment Actually Measure? — our guide to the cultural conditions a meaningful assessment should examine, including leadership, norms, confidence, psychological safety and security experience.
- Security Culture Assessment vs. Human Risk Assessment: What's the Difference? — how culture assessment fits inside the wider Human Risk Management picture and why culture, behavior and risk should not become interchangeable terms.
- Measuring Cyber Security Culture: NCSC-Aligned Metrics That Actually Work — a deeper look at practical culture metrics and why traditional awareness measures show only part of the picture.
- A CISO's Guide to Cybersecurity Culture — a broader strategic look at culture, organizational context, leadership and the role culture plays inside modern Human Risk Management.
- 5 Culture Warning Signs Your Agentic AI Rollout Is Creating More Risk Than Value — how culture becomes visible as organizations introduce agentic AI, particularly around experimentation, ownership, challenge and human oversight.
Cybersecurity culture has never really been about whether people can recite the policy. It is about the environment in which security decisions are made: what the organization signals is important, what teams normalize, what leaders reinforce and what employees discover is actually possible when the work gets difficult.
Measurement should be capable of seeing that.
Frequently Asked Questions
How do you measure cybersecurity culture?
Cybersecurity culture is best measured by combining perception, qualitative, behavioral and organizational evidence. Surveys can assess beliefs, attitudes, norms, confidence and employees' experience of security; qualitative research provides context; and behavioral and operational evidence helps show what happens in real work.
What metrics measure security culture?
Useful security culture measures depend on the condition being assessed. They may include measures related to leadership, shared norms, risk perception, confidence, psychological safety, organizational support, policy experience, workflow friction and relevant behavioral patterns. Training completion and phishing metrics can provide supporting evidence but should not be treated as complete measures of culture.
Can cybersecurity culture be measured with a survey?
Yes. Surveys are useful because beliefs, perceptions, attitudes and norms cannot always be directly observed. Stronger culture assessment generally combines survey findings with qualitative, behavioral or organizational evidence rather than relying on self-report alone.
What is triangulation in cybersecurity culture assessment?
Triangulation means examining a cultural condition using multiple relevant evidence sources. For example, an organization might compare employees' reported confidence in escalating security concerns with interviews and actual reporting patterns to develop a more reliable interpretation.
Can phishing data measure security culture?
Phishing data can provide behavioral evidence relevant to some culture questions, but it does not directly measure the beliefs, norms, leadership conditions or organizational experiences behind that behavior. It should therefore be interpreted alongside other relevant evidence.
How often should cybersecurity culture be measured?
Deep culture assessments are typically periodic, while lighter pulse measures and relevant behavioral evidence can be reviewed more frequently. Organizations may also reassess culture following significant events such as acquisitions, leadership changes, major incidents, restructuring or large-scale technology adoption.
How do you know whether cybersecurity culture is improving?
Improvement is more credible when multiple relevant forms of evidence show movement in the cultural condition being addressed. That may include changes in survey responses, qualitative findings, behavioral patterns and operational evidence following a defined intervention.
What is the difference between measuring security culture and measuring human risk?
Security culture measurement examines organizational conditions that shape security behavior. Human risk measurement is broader and may combine culture with competency, psychology, behavior, access, threat exposure, security evidence, organizational context and potential consequence.
