A cybersecurity culture assessment should measure the shared organizational conditions that influence how people understand, experience and act on cybersecurity in the course of real work.
That means looking beyond awareness scores, phishing results and individual behavior. A meaningful culture assessment should examine factors such as leadership, shared norms, trust, accountability, risk perception, confidence, psychological safety, communication, workflow friction, organizational support and whether secure behavior is actually practical in the environment people work within.
Behavioral, identity, access and threat data can add valuable context. They can help show where human-related risk is concentrated and what may be happening operationally. They do not, by themselves, tell you what the culture is.
That distinction matters.
At Cybermaniacs, we see security culture assessment, human risk assessment and human risk intelligence as related but different jobs. Culture assessment helps explain the conditions shaping behavior. Human risk assessment helps determine where human-related exposure and consequence matter. Human risk intelligence connects evidence across those layers so the organization can decide what to do.
Treating all three as the same thing makes the dashboard neater. It does not necessarily make the risk any easier to understand.
What Is a Cybersecurity Culture Assessment?
A cybersecurity culture assessment evaluates the beliefs, values, attitudes, norms and organizational conditions that influence how people behave around cybersecurity.
That definition is well supported by the research.
MIT Sloan's cybersecurity culture work defines organizational cybersecurity culture around the attitudes, beliefs and values that drive cybersecure behavior. Their research also emphasizes that those cultural conditions are shaped at leadership, group and individual levels rather than residing solely inside an employee's knowledge or decision-making.
NIST takes a similarly broad view. Its Human-Centered Cybersecurity program defines security culture in terms of organization-wide values, attitudes and beliefs, while separately recognizing human-system interaction, workflows, friction, psychology and learning as important dimensions of the environment in which secure behavior occurs.
A major 2025 rapid evidence review published in Computers & Security reached a similar conclusion after synthesizing 59 studies. The authors found that cybersecurity culture should not be viewed purely as a technical problem and highlighted top-management involvement, organizational support, cultural values, norms, motivation, awareness and capability as important parts of the culture-behavior relationship.
That gives us a useful starting point:
Cybersecurity culture is about the organizational conditions that make certain security behaviors more or less likely.
A culture assessment should therefore try to understand those conditions, not simply count the behaviors that emerge from them.
Why Is Cybersecurity Culture Difficult to Measure?
Culture is difficult to measure because much of it is not directly observable.
You can observe whether someone reported a suspicious email. You cannot directly observe the degree to which they believe reporting is encouraged, whether they trust the security team to respond constructively, whether they worry about looking foolish, whether their manager implicitly discourages interruption, or whether previous experiences have taught them that reporting is pointless.
Those things matter because they influence what happens next.
This is one of the reasons culture assessment is fundamentally different from telemetry.
Surveys tell you what people say. Telemetry tells you what happened. Culture assessment is trying to understand why.
None of those evidence sources is perfect.
Surveys can be affected by social desirability, interpretation, response bias and the familiar gap between what people say they do and what they actually do. Behavioral evidence shows what occurred but often cannot explain motivation, intent or organizational conditions. Qualitative interviews provide rich context but are harder to scale. Security-event data can reveal important patterns while still leaving management to work out why those patterns exist.
Research on security culture measurement has repeatedly identified these challenges. A systematic review of culture-measurement approaches noted that questionnaires and surveys are widely used but have limitations, while relatively few security-culture frameworks have been thoroughly evaluated in real-world settings.
The answer is not to abandon measurement.
It is to triangulate.
A credible cybersecurity culture assessment uses enough different forms of evidence to avoid mistaking one measurement method for the culture itself.
What Should a Cybersecurity Culture Assessment Measure?
There is no single public checklist that will fit every organization, and Cybermaniacs does not recommend treating culture assessment as a generic questionnaire that can be dropped unchanged into any workforce.
Different industries, operating models, leadership structures, threat environments and workforce conditions shape culture differently.
There are, however, several broad areas that a meaningful assessment should examine.
Leadership and Security Expectations
People pay attention to what leaders repeatedly prioritize, reward, tolerate and ignore.
Leadership culture is therefore not simply about whether executives say security is important. A culture assessment should look at whether security expectations appear consistently in decisions, communications, resource allocation and day-to-day management behavior.
MIT Sloan's research repeatedly emphasizes this leadership layer. Culture is reinforced when executives visibly prioritize cybersecurity and when employees see security reflected in what managers actually do.
The distinction between stated values and lived values matters.
Most organizations have excellent values on the intranet.
The interesting question is what happens when the deadline is Friday.
Shared Norms and Social Influence
People learn how work is really done from the people around them.
A policy may say one thing while the local norm says something else. A team may routinely ask for security guidance before introducing new tools, while another quietly works around controls because that is simply how the work gets finished.
Those patterns are cultural.
A culture assessment should therefore look at shared expectations, peer behavior and the degree to which secure practice is reinforced within teams rather than assumed to flow automatically from corporate policy.
The 2025 evidence review identifies norms and organizational support as central dimensions in the culture-behavior relationship.
This is especially important because culture is rarely uniform across an enterprise.
The organization may have one corporate security policy and twenty local versions of "how we actually do things here."
Risk Perception and Personal Relevance
People are more likely to respond appropriately to a risk they understand and believe is relevant to their work.
That does not mean everyone needs to become a threat-intelligence analyst. It means employees need an appropriate understanding of the risks associated with their role, environment and decisions.
A culture assessment should explore whether security feels relevant, whether people understand the possible consequences of unsafe decisions and whether risk is framed in a way that connects to actual work.
Generic fear is not the objective.
Useful risk perception is.
Confidence and Self-Efficacy
Knowing the correct action and feeling able to take it are not the same thing.
An employee may recognize that something is suspicious while lacking confidence about whether it warrants escalation. Someone may understand the policy while feeling unable to challenge a senior executive. A manager may know that an AI-generated result should be reviewed while lacking enough domain understanding to perform that review effectively.
Self-efficacy matters because secure behavior often depends on people believing they are capable of acting appropriately.
The 2025 evidence review explicitly includes capability and perceived behavioral control among the constructs relevant to the culture-behavior relationship.
A good assessment therefore asks whether people feel equipped to perform the security behaviors the organization expects from them.
Psychological Safety and Willingness to Speak Up
Security depends heavily on employees being willing to admit uncertainty.
People need to be able to say, "I think I clicked something," "this process does not make sense," "I am not sure whether this is safe," or "the AI system did something strange" without first calculating the personal cost of raising the concern.
That is partly a security issue and partly an organizational one.
Recent research on cyber incident reporting reinforces this point. A 2026 systematic review drawing on 106 peer-reviewed studies found that reporting behavior is influenced by organizational, psychological, technical, social and motivational factors, and specifically highlighted psychological safety and managerial practices as important conditions for stronger reporting behavior.
If employees believe they will be embarrassed, blamed or ignored, the organization may have a reporting problem that no amount of "See Something, Say Something" artwork will solve.
A culture assessment should be able to see that.
Policy and Control Experience
Policies live in documents. Employees experience them as workflows.
That difference matters.
A control can be logically sound and still create enough friction that people routinely work around it. A policy can be technically clear while remaining difficult to apply in ambiguous circumstances. A security process can be well designed on paper while requiring three approvals and a small act of pilgrimage in practice.
NIST's human-centered cybersecurity work explicitly focuses on aligning security with human psychology and workflows, reducing friction and making secure behavior easier to perform.
A culture assessment should therefore examine how employees actually experience controls and policies.
If the secure action is consistently the hardest action available, the resulting behavior tells us something about the system as well as the person.
Can Security Culture Be Measured From Behavior Alone?
No.
Behavior is extremely valuable evidence, but the same observed behavior can emerge from very different cultural conditions.
Imagine two employees follow the same security process perfectly.
One does so because they understand the risk, believe the control is important and feel personally responsible for protecting the organization.
The other does so because the system leaves no alternative and their manager has threatened disciplinary action.
Same behavior.
Different culture.
Now imagine the control disappears.
The difference suddenly matters.
This is why observed behavior should not automatically be treated as a direct measure of culture.
Behavior can provide evidence about the culture, particularly when patterns repeat across groups and over time. But understanding why the behavior exists requires other forms of evidence.
MIT Sloan's culture model explicitly treats values, attitudes and beliefs as related to behavior rather than identical to it, with managerial mechanisms and external influences shaping the cultural system around those behaviors.
That distinction is useful because it prevents culture assessment from becoming another name for behavioral analytics.
Where Do Identity, Access and Threat Data Fit?
Identity, access, threat and behavioral data are enormously useful for Human Risk Management.
They help answer different questions.
Identity and access evidence can tell us what authority or system access a person or role holds.
Threat intelligence can show what kinds of attacks the organization or population currently faces.
Behavioral evidence can show what people actually did.
Security-event data can show when those actions intersect with systems or incidents.
That is rich human-risk context.
But those data sources do not necessarily explain whether people trust security, whether leadership behavior supports safe decisions, whether employees feel able to challenge something unusual, whether local norms encourage workarounds or whether secure action is practical in the environment.
Those are culture questions.
Cybermaniacs' guide to how to measure human cyber risk explores how different evidence sources become more useful when connected into signals, patterns and risk conditions rather than treated as isolated metrics.
The distinction we make is straightforward:
Culture evidence helps explain the conditions shaping behavior. Risk evidence helps explain where that behavior matters.
Mature Human Risk Management needs both.
What Is the Difference Between a Security Culture Assessment and a Human Risk Assessment?
A security culture assessment asks:
What organizational conditions are shaping how people think about and act on cybersecurity?
A human risk assessment asks:
Where is human-related cyber risk concentrated, what is contributing to it and what consequence could follow?
The two overlap, but they are not interchangeable.
Culture may be one contributing factor in a human risk condition.
For example, a population may demonstrate weak reporting behavior. Culture assessment might show that employees worry about being blamed for false alarms. Human risk analysis could then combine that finding with role, threat and incident evidence to determine whether poor reporting creates material exposure.
The culture assessment helps explain the condition.
The risk assessment determines why it matters.
This distinction is important because not every cultural weakness produces the same level of risk, and not every human risk condition is primarily cultural.
A person may have excellent security attitudes and still lack the competency required for a new threat. A team may have strong norms but operate inside a badly designed process. A risky action may result from fatigue, cognitive overload, technical friction or a simple mistake rather than a deep cultural problem.
Human Risk Management needs enough diagnostic range to tell the difference.
What Is the Difference Between Security Culture Assessment and Human Risk Intelligence?
Human risk intelligence is the broader interpretive layer.
It brings together relevant evidence from culture, competency, psychology, behavior, technology, identity, threat, organizational context and security systems to understand what is happening and what action may be required.
Culture assessment contributes an important part of that picture because it helps explain the environment in which human behavior occurs.
But culture alone does not tell us consequence.
Consider a business unit where employees demonstrate low confidence in escalating security concerns.
That is a meaningful culture finding.
If the same business unit operates critical infrastructure, experiences frequent social-engineering attempts and has access to sensitive systems, the human-risk significance of that finding becomes much greater.
Context changes the decision.
This is why Cybermaniacs' public Human Risk Management Capability Map separates capabilities such as Understand & Diagnose, Influence Behavior & Culture, Connect Evidence & Context and Measure Risk & Change.
Different capabilities contribute different parts of the answer.
Can You Measure Cybersecurity Culture With a Survey?
Yes, but a survey should rarely be the only evidence used.
Surveys are valuable because many cultural conditions are internal and cannot be observed directly. Beliefs, attitudes, confidence, perceptions of leadership, psychological safety and perceived norms often need to be asked about.
The research supports that approach. The 2025 evidence review identified validated questionnaire constructs covering areas including awareness, motivation, capability, norms and organizational support.
The limitations are equally important.
People may answer in ways they believe are socially desirable. Employees can interpret questions differently. A survey captures perceptions at a point in time. Strong stated attitudes do not guarantee corresponding behavior.
That does not make surveys unreliable.
It means the findings become stronger when compared with other evidence.
If employees report high confidence in escalating suspicious activity but operational reporting data shows almost nobody ever does, the disagreement is interesting.
If leaders believe they consistently reinforce secure behavior while employees report the opposite, that disagreement is interesting too.
Sometimes the gap between evidence sources tells us more than either source alone.
How Often Should You Assess Cybersecurity Culture?
Security culture does not necessarily need to be assessed on the same cadence as operational risk telemetry.
Behavioral and security signals may be monitored continuously. Phishing data may arrive monthly. Incident patterns can change in days. Threat exposure may shift even faster.
Culture generally moves differently.
Deep culture assessment may therefore make sense periodically, with lighter pulse measures or targeted diagnostics used between major assessments. Organizations may also reassess around material changes such as mergers, leadership transitions, significant technology adoption, restructuring, major incidents or large-scale AI deployment.
The right cadence depends on what the organization is trying to understand.
Culture is not a Fitbit.
There is little value in taking its pulse every five minutes simply because the platform can.
The better question is whether enough has changed to justify reassessment and whether the organization needs fresh evidence to make a decision.
How Should Organizations Use Security Culture Assessment Results?
A culture assessment should lead to diagnosis before it leads to intervention.
If people understand security expectations but believe raising concerns will damage their reputation, the answer may involve leadership and psychological safety.
If people want to act securely but the approved process consistently prevents them from getting work done, the answer may involve workflow or control redesign.
If employees have supportive managers and sensible processes but lack the relevant capability, targeted learning may be entirely appropriate.
Those are different problems.
They should not all end with another training module.
This is one of the reasons Cybermaniacs treats culture as part of a broader Human Risk Management operating capability. Assessment should help the organization determine what is actually driving the condition before deciding what to change.
A useful sequence is:
understand the cultural condition → compare it with other evidence → identify the risk significance → choose the intervention → measure what changes
The proprietary assessment instruments, scoring methods and diagnostic logic used to do that well will vary. The public principle is simpler: culture measurement should produce enough understanding to support a better decision.
What Does a Good Cybersecurity Culture Assessment Look Like?
A strong assessment should be broad enough to examine the organization rather than treating every problem as an individual employee problem.
At a minimum, it should:
- be grounded in credible research;
- distinguish perception from observed behavior;
- recognize that culture varies between teams, roles and operating environments;
- examine leadership, norms, confidence, organizational support, friction and the lived experience of security;
- connect qualitative and quantitative evidence where appropriate; and
- show management where deeper investigation is required.
It should also resist the temptation to compress everything into one authoritative-looking number. A single score can be useful for communication, but it should never become a substitute for understanding the conditions underneath it.
The objective is not to declare that the company has a 73.4% security culture. The objective is to understand enough about the cultural environment to make better risk decisions.
Cybersecurity Culture Is Part of the Risk Story, Not the Whole Story
Human Risk Management has access to more workforce evidence than ever before.
That is useful.
Behavioral telemetry, identity systems, threat intelligence, security platforms and learning systems can give organizations extraordinary visibility into events, patterns and exposure.
But visibility into what people did is not always the same thing as understanding why they did it.
Culture helps fill that gap.
It tells us something about the organizational environment surrounding the behavior: what people believe matters, what teams normalize, what leaders reinforce, where people feel confident, where they stay quiet, and whether the secure path makes sense in the realities of the work.
That is why Cybermaniacs treats security culture as an important part of Human Risk Management without collapsing it into every other form of human-risk evidence.
If we want to understand human cyber risk well enough to manage it, we need to know what happened.
We also need to understand the organization in which it happened.
Frequently Asked Questions
What should a cybersecurity culture assessment measure?
A cybersecurity culture assessment should examine organizational conditions that influence secure behavior, including leadership, shared norms, risk perception, confidence, psychological safety, organizational support, policy experience, workflow friction and relevant behavioral patterns. The exact dimensions should reflect the organization's context and assessment purpose.
Is security culture the same as human risk?
No. Security culture concerns the organizational values, attitudes, beliefs, norms and conditions that influence behavior. Human risk is broader and can also involve competency, behavior, access, threat exposure, business consequence, psychology, technology and other contextual factors.
Can behavior data measure cybersecurity culture?
Behavioral data can provide useful evidence about culture, but behavior alone cannot explain why the behavior occurred. The same observed action can emerge from very different beliefs, norms, incentives and organizational conditions.
Can a cybersecurity culture assessment be survey-based?
Yes. Surveys are commonly used because beliefs, perceptions and attitudes cannot always be observed directly. Stronger assessments often compare survey evidence with qualitative, behavioral and organizational evidence rather than relying on a questionnaire alone.
How often should cybersecurity culture be assessed?
The appropriate cadence depends on the organization and the purpose of the assessment. Deep culture diagnostics may be conducted periodically, with lighter pulse measures between assessments or reassessment following significant organizational, technological or risk changes.
What is the difference between a security culture assessment and a human risk assessment?
A security culture assessment examines the organizational conditions shaping cybersecurity behavior. A human risk assessment examines where human-related cyber risk exists, what contributes to it and what consequences could follow. Culture evidence may form one part of a broader human risk assessment.
What should organizations do with security culture assessment results?
Assessment results should be used to diagnose the conditions contributing to a problem before choosing an intervention. Depending on the finding, the appropriate response may involve leadership, process design, controls, communication, learning, management practices or other organizational changes.
