What Human Cyber Risk Metrics Should CISOs Report to the Board?

CISOs should report human cyber risk metrics that help the board understand material exposure, risk concentration, change over time, control effectiveness, resilience and significant residual risk. Training completion rates and phishing simulation results can contribute useful evidence, but they should not be treated as complete measures of human cyber risk.

The board does not need every metric the Human Risk Management team uses to run the program. It needs a small set of measures that helps directors answer a much more important question: Are we becoming better at understanding and reducing the human-related cyber risks that matter to the business?

That distinction changes what belongs in the board pack.

At Cybermaniacs, we think human risk measurement should begin with the risk question the organization is trying to answer, then determine what evidence is needed to answer it. Starting with the metric because the technology happens to generate it is one of the easiest ways to create a dashboard full of numbers that looks sophisticated while saying surprisingly little about risk.

What Human Cyber Risk Metrics Belong in a Board Report?

There is no universal human cyber risk scorecard that every organization should copy. The metrics a financial institution needs may differ substantially from those needed by a manufacturer, airline, healthcare provider or technology company because the workforce, threats, critical processes and consequences are different.

There are, however, several categories of evidence that can give boards a useful view of human cyber risk.

These categories are deliberately broader than the metrics traditionally associated with security awareness.

NACD's 2026 guidance on cybersecurity risk reporting makes a similar recommendation at the wider cyber-risk level. It asks boards to look at cyber posture, exposure, resilience and quarter-over-quarter trends, with the information translated into business, financial and operational terms rather than presented primarily as technical data.

That same principle should apply to the human layer.

1. Human Risk Exposure Metrics

The first job of a board-level metric is to help explain where material exposure exists.

A simple workforce average usually cannot do that.

Imagine an organization where 97 percent of employees demonstrate strong performance against a particular social-engineering scenario. That sounds reassuring until the remaining three percent includes members of the treasury team authorized to release large payments, executives routinely targeted for impersonation, or administrators with privileged access to critical systems.

The enterprise average did not become mathematically wrong. It became strategically misleading.

Useful exposure reporting therefore looks at the relationship between human evidence and the business context around it. Depending on the organization, that may include role, access, business process, threat exposure, organizational unit, geography, critical asset interaction or the potential consequence of an unsafe action.

The board does not need employee-level risk profiles. It needs visibility into whether meaningful human-related exposure exists in places where the consequence matters.

This is one reason Cybermaniacs treats context as an essential part of human risk measurement. An event, assessment result or behavior becomes more useful when the organization can interpret what it means in relation to actual exposure rather than assuming that every person, action and scenario carries equivalent risk.

Our guide on how to measure human cyber risk explores this distinction between raw events, metrics, signals, patterns and risk conditions in more detail.

2. Human Risk Concentration Metrics

Boards should also know whether risk is concentrated.

Enterprise averages can hide pockets of weakness, and those pockets often matter more than broad workforce performance. A particular role may repeatedly demonstrate weak verification behavior. A business unit may have strong technical controls but poor reporting confidence. A geography may experience substantially more social-engineering activity. A critical process may depend on human judgment at exactly the point where attackers are applying pressure.

This does not mean every difference is automatically material risk.

A concentration becomes useful for governance when the organization can explain why it matters, what evidence supports the concern and what business outcome might be affected.

Reporting concentration helps move Human Risk Management away from the idea that the workforce is a single homogeneous population. It allows the CISO to say, for example, "Our overall position is stable, but exposure associated with payment authorization remains elevated within two operating groups, so we are treating that population separately."

That is a much better board conversation than "the company phishing failure rate is 4.7 percent."

3. Human Risk Trend Metrics

A snapshot tells the board where the organization appears to be today. A trend begins to show whether management is changing the condition.

This makes direction of travel one of the most useful dimensions of board reporting.

For a material human risk condition, the board should be able to see whether the relevant evidence is improving, deteriorating or remaining persistent, ideally alongside an explanation of what management expected to happen.

NACD's 2026 board-reporting model specifically recommends quarter-over-quarter trends because directors need to assess performance over time rather than interpret isolated measurements. Deloitte similarly recommends that quarterly reporting monitor progress toward risk reduction, prevention and resilience rather than function simply as a periodic inventory of security activity.

Human risk reporting should do the same.

Suppose reporting behavior improves after a targeted intervention but then begins declining again six months later. That is different from a one-time improvement. It may suggest that the intervention created temporary change without altering the surrounding conditions sufficiently to sustain it.

That is exactly why trends matter.

4. Control and Intervention Effectiveness Metrics

One of the most important questions the board can ask is also one of the simplest:

Did what we did actually work?

Human Risk Management programs have many available interventions. Learning may be appropriate. So might targeted communications, simulations, coaching, technical controls, process changes, role-specific exercises, leadership intervention or changes to the surrounding working environment.

The useful metric is not merely whether the intervention happened.

It is whether the condition the intervention was intended to influence changed.

If a program identifies weak reporting behavior and launches a reporting campaign, measuring campaign reach tells management something about delivery. Measuring subsequent reporting behavior begins to say something about effectiveness.

If a high-risk role requires stronger verification capability, assessment participation is an activity measure. Improvement in the relevant capability is an outcome measure. A later reduction in events associated with that weakness could provide additional evidence, although the organization still needs to be careful about claiming causality.

This distinction matters because activity is not the same as effectiveness.

Board reporting should therefore make clear what an intervention was intended to change and what evidence management is using to determine whether it worked.

5. Human Resilience Metrics

Not every cyber risk can be prevented, which means good human risk reporting also needs to consider what happens when normal defenses fail.

Can people recognize something unusual?

Do they report it?

Do they know when to escalate?

Can the organization respond quickly enough to contain the consequences?

Can teams adapt when a process, technology or threat behaves differently from what they expected?

These are resilience questions.

Deloitte's 2026 board guidance identifies resilience and preparedness as a core reporting category and recommends measures that help directors understand whether the organization can withstand and recover from cyber disruption. Human resilience belongs within that broader picture because employees are often involved in detection, escalation, intervention and recovery long before a situation reaches a formal incident-response workflow.

Useful human resilience evidence might therefore include reporting behavior, escalation quality, speed of response, effectiveness of recovery actions or evidence that critical populations can perform appropriately when faced with ambiguous or abnormal situations.

The objective is not to invent another universal resilience score.

It is to understand whether the human layer continues to function effectively when conditions become difficult.

6. Human Risk Management Capability Metrics

Boards may also need visibility into whether the organization has the capability to manage human cyber risk consistently.

This is different from measuring the risk itself.

A company can have a serious exposure while possessing strong capability to identify and address it. Another organization may appear relatively stable while lacking the measurement, governance or intervention capability needed to recognize when conditions change.

That distinction is important because management needs both risk visibility and management capability.

Cybermaniacs' public Human Risk Management Capability Map describes six connected capabilities: Understand & Diagnose, Develop Capability, Influence Behavior & Culture, Connect Evidence & Context, Measure Risk & Change, and Operate & Adapt. The map is intentionally a public capability model rather than a disclosure of the proprietary measurement and diagnostic methods underneath it.

For board reporting, the useful question is not whether the company can claim to possess all six labels. It is whether a material gap in the organization's ability to understand, influence, measure or govern human risk requires attention or investment.

7. Residual Human Risk and Decision Metrics

The board should not only see what has improved.

It should also know what remains unresolved.

Residual risk reporting helps management identify conditions that remain above tolerance, interventions that have not achieved sufficient change, exposures the organization has consciously accepted, or areas where further investment is required.

This is where a metric becomes part of governance rather than simply analytics.

A useful board statement might be:

"Risk associated with executive impersonation remains elevated despite improved verification behavior. We have reduced exposure through process and control changes, but residual risk remains above our desired position because of increasing attack sophistication. Management recommends additional controls around high-value transaction approval."

The numbers supporting that statement matter.

The decision matters more.

NACD's 2026 guidance emphasizes precisely this movement from technical reporting toward information that helps directors assess risk posture, resource allocation and strategic exposure.

Which Human Risk Metrics Should Not Be Used Alone?

Several familiar Human Risk Management metrics are useful operationally but easy to overstate when presented to a board.

Training Completion Rate

Completion rate answers a legitimate question: Did the intended population complete the assigned learning?

It does not answer whether people learned what they needed to learn, whether behavior changed or whether cyber risk decreased.

Completion is therefore a delivery or coverage metric, not proof of risk reduction.

For compliance purposes, completion may still matter greatly. The problem is not the metric. The problem is asking it to answer a question it cannot answer.

Phishing Click Rate

Phishing simulations can produce valuable behavioral evidence.

A click rate can help identify patterns, compare appropriately controlled scenarios or support targeted intervention. But its meaning depends heavily on context, including scenario design, population, difficulty, reporting behavior and the threat being simulated.

NACD's example board scorecard includes phishing click rate as a culture measure, illustrating that the metric can be relevant at board level. Cybermaniacs would add an important qualification: a phishing click rate should be treated as one piece of evidence about a specific human-risk condition, not as a complete measure of the organization's human cyber risk.

Awareness or Assessment Scores

Assessment scores can show whether people demonstrate knowledge, recognition or capability against what was measured.

That can be useful.

But knowing something and consistently acting on it are not the same thing. Neither automatically establishes the business consequence associated with failure.

Assessment evidence becomes stronger when interpreted alongside behavioral evidence, exposure and organizational context.

A Single Human Risk Score

A composite score can make complex information easier to consume, which is one reason organizations find scores attractive.

The danger comes when a single number creates more confidence than the evidence underneath it deserves.

A score may combine several useful measurements, but the board should still understand what it represents, what it does not represent, what evidence feeds it and whether important dimensions of risk have disappeared during aggregation.

A simple number is useful when it simplifies communication.

It becomes dangerous when it simplifies the risk itself.

What Is the Difference Between an Activity Metric, an Outcome Metric and a Risk Metric?

This distinction can dramatically improve board reporting.

An activity metric shows what the program did. Training assignments, campaign reach, simulation volume and communications delivered are examples.

An outcome metric shows whether something changed following an intervention. That might include improved capability, better reporting behavior or reduced recurrence of a targeted behavior.

A risk metric helps management understand a condition relevant to potential harm. It requires some connection to exposure, consequence, likelihood, business context or another meaningful dimension of risk.

Those categories can overlap, and the same underlying evidence can contribute to different questions. The important point is not to label every measure perfectly. It is to avoid presenting evidence of activity as if it proves an outcome, or presenting an outcome as if it automatically proves a quantified reduction in enterprise risk.

NIST's 2026 guidance connecting cybersecurity, enterprise risk management and workforce management reinforces this need to align workforce decisions with actual cybersecurity risk conditions and planned risk responses.

That is a useful standard for Human Risk Management too.

How Many Human Cyber Risk Metrics Should the Board See?

Probably fewer than the operational Human Risk Management dashboard contains.

Boards need enough information to understand material exposure, direction, effectiveness and decisions. They do not need every diagnostic measure the security or HRM team uses underneath that analysis.

Five meaningful measures with clear interpretation can be more useful than twenty-five isolated KPIs.

The exact number matters less than the discipline used to select them.

Before putting a metric into the board pack, ask:

What risk question does this metric help answer?

Then ask whether the board needs the number itself or the conclusion management has drawn from it.

For example, the HRM team may analyze a dozen underlying measures before determining that reporting confidence and reporting behavior have deteriorated within a particular high-exposure population. The board may not need all twelve measures. It needs the resulting risk condition, the evidence supporting management's confidence in that conclusion, the direction of travel and what is being done about it.

This creates a healthier separation between operational analytics and governance reporting.

How Should Human Cyber Risk Metrics Change as AI Adoption Grows?

AI is expanding what organizations may eventually need to measure.

Employees are increasingly using AI to create, analyze and decide. Some are delegating tasks to systems that can perform multi-step work. Human responsibility may shift from directly performing an action toward supervising, reviewing, approving or intervening in machine-generated work.

Traditional awareness metrics tell us very little about whether people can perform those responsibilities effectively.

Organizations may increasingly need evidence related to safe AI use, inappropriate delegation, verification behavior, escalation, overreliance, human intervention and the ability to supervise AI-enabled workflows.

That does not mean every organization needs an "AI human risk score" tomorrow.

It means the measurement model has to evolve as the work changes.

Cybermaniacs sees this as part of a larger move toward human resilience: understanding whether people can exercise appropriate judgment, oversight and adaptation as cybersecurity and AI risk become more interconnected.

A Better Test for Every Human Risk Metric

Before a Human Risk Management metric reaches the board, management should be able to explain what it measures, why it matters, what context changes its interpretation, how it is trending and what action the organization would take if the result materially changed.

If those questions cannot be answered, the metric may still be operationally useful.

It probably is not yet board-ready.

The goal is not to create the world's largest Human Risk Management dashboard. It is to create enough reliable evidence for management and the board to understand where meaningful human-related cyber risk exists, whether the organization is changing it and where a decision is required.

That is the measurement shift Cybermaniacs believes Human Risk Management needs to make.

Frequently Asked Questions

What human cyber risk metrics should CISOs report to the board?

CISOs should prioritize metrics that show material human risk exposure, risk concentration, trends over time, control and intervention effectiveness, resilience and significant residual risk. Activity measures such as training completion and phishing simulation results can provide supporting evidence but should not be treated as complete measures of human cyber risk.

Is phishing click rate a human risk metric?

Phishing click rate is a behavioral metric that can provide evidence about a specific human-risk condition. Its meaning depends on factors including scenario design, population, threat context and reporting behavior, so it should not be used alone as a measure of overall human cyber risk.

Is training completion a human risk metric?

Training completion is primarily an activity or coverage metric. It can demonstrate that required learning was delivered and completed but does not by itself demonstrate increased capability, behavior change or risk reduction.

What is the difference between a human risk metric and a human risk score?

A metric measures or summarizes a particular form of evidence, such as reporting rate, assessment performance or event frequency. A human risk score typically combines or transforms multiple measures into a summary value. Scores can support communication but should not hide the evidence, assumptions and context underneath them.

How many human cyber risk metrics should a board see?

There is no universal number. Boards generally need a small set of metrics sufficient to understand material exposure, trends, intervention effectiveness, resilience and residual risk. Detailed diagnostic and operational metrics should remain available to management without necessarily appearing in the board pack.

How should CISOs show that human cyber risk is decreasing?

CISOs should show relevant changes in the risk condition being managed rather than relying solely on evidence that an intervention occurred. Depending on the problem, that might include changed behavior, improved capability, stronger reporting or escalation, fewer recurring events, reduced exposure or other evidence tied to the original risk question.

Should every organization use the same human risk metrics?

No. Appropriate human risk metrics depend on the organization's workforce, threat environment, business processes, technology, regulatory requirements, risk appetite and potential consequences. The metric should follow the risk question rather than being selected simply because a platform makes it available.