Security awareness programs can report who completed training, clicked a simulation, or passed a quiz. Those metrics provide useful evidence of participation and practice. They offer less insight into whether employees can recognize and respond to a real phishing threat when it reaches their inbox, whether that is days or months later.
Cofense’s Beyond Human Risk: Measuring Secure Behavior with an AI-Driven Platform webinar examined how Secure Behavior Management (SBM) closes that gap through competency measurement, which shows what employees can actually demonstrate rather than what they have completed. The Cofense platform brings together employee competency, real-world phishing behavior, and the actions organizations can take to improve readiness.
Here are five key takeaways.
1. Training activity does not establish phishing readiness
Completions confirm that employees took a course. Simulation results show how they responded in a controlled exercise. Quiz scores indicate whether they could recall specific information at a particular moment.
Each measure has a place, including in compliance reporting. But none can establish, on its own, what an employee will do when a different phishing email reaches their inbox. A security program must also understand whether people retain what they learn and apply it as threats change.
That requires moving beyond a record of activities toward evidence of capability. As explored in Beyond Human Risk: A Better Way to Build Secure Behavior, the central question is whether employees are getting better at recognizing and responding to phishing.
2. Secure Behavior Management puts the organization in a position to act
Human Risk Management broadened the signals available to security teams, but its scores often center on which employees present the greatest risk. Identifying exposure is useful. Improving the conditions that produce secure behavior requires another step.
SBM focuses on the capabilities employees need and the support the organization provides. It follows a continuous cycle: train people on relevant threats, measure what they can demonstrate alongside their response to real attacks, and act on the gaps.
The appropriate action depends on the evidence. An employee struggling with a particular tactic may benefit from focused reinforcement. Someone who consistently responds well but receives a high volume of targeted attacks may need stronger mailbox protection. Cofense’s SBM approach is designed to help teams make that distinction.
3. Competency measurement should expose program gaps as well as learner gaps
Strong results on a limited set of simulations do not indicate readiness across every phishing tactic. Security leaders need to know which threats their program covers and how employees perform against those topics.
Cofense’s Competency Dashboard measures performance across 26 phishing threat topics, with views from the individual employee through teams and the organization. It can show where employees demonstrate knowledge and where the program has provided too little coverage.
This makes the measure more useful than an overall completion or click rate. A program can identify the topics that need attention and direct phishing training and reinforcement accordingly, rather than assigning the same material to everyone.
4. Real phishing behavior provides context that simulations cannot
A simulation gives employees a chance to practice. A real phishing email shows what reached the organization and how people responded when the stakes were different.
Consider an employee who recognizes a malicious message and quietly deletes it. They may have avoided the attack, but the security team did not receive the report it needed to investigate and protect others. In another case, an employee may report correctly while facing repeated, highly targeted threats. More training alone would not address that exposure.
Employee reporting and Phishing Remediation provide context for choosing the right response. They help connect secure behavior with threat identification and containment after phishing gets through preventive controls.
5. Connected measurement should show progress over time
Training, reporting, and remediation each reveal part of a phishing defense program’s effectiveness. Bringing those signals together can show whether education reflects the threats reaching an organization and whether employees’ responses improve.
The Competency Dashboard is the first stage of this view. Cofense plans to add Triage and Vision remediation data to Command Center later in 2026, bringing real-world phishing signals alongside training competency. The proposed combined Cofense Score is intended to help organizations assess their own progress over time, rather than serve as a universal pass mark or a ranking of employees.
That connected view supports a practical goal: make better decisions about where to reinforce learning, where to improve protection, and how to strengthen phishing defense across the organization. Learn more about the Cofense Phishing Defense Platform and its SBM expansion.
Watch the full discussion
For a closer look at competency measurement, the connected platform roadmap, and how Secure Behavior Management can inform action, watch Beyond Human Risk: Measuring Secure Behavior with an AI-Driven Platform on demand.