How Does an SME Cyber Security Provider Measure Security Awareness?

Security awareness is measured by examining whether employees understand their security responsibilities and apply them consistently in everyday work. A useful assessment therefore looks beyond participation in awareness activity and gathers evidence of decision-making, adherence to procedures and the organisation’s exposure to avoidable human error.

Start with defined security behaviours

Before choosing metrics, an SME should identify the behaviours that matter most to its risks. These may include locking screens, using approved file-sharing methods, applying multi-factor authentication correctly, handling personal or commercially sensitive data appropriately, checking unusual payment instructions through an independent channel, and escalating a suspected mistake according to internal procedures.

Each behaviour should have a clear standard. For example, “protect confidential information” is difficult to measure, whereas “store client documents only in approved business locations and do not transfer them to personal accounts” provides a more useful basis for observation and review.

Use a balanced set of measures

No single metric gives a reliable picture of awareness. An SME cyber security provider will usually combine several types of evidence:

• Knowledge measures: scenario-based questions or discussions can establish whether staff understand why a control exists and what to do when the normal process does not clearly apply.
• Behavioural measures: reviews can examine whether agreed practices are being followed, such as correct data classification, appropriate use of removable media or secure handling of documents outside the office.
• Operational measures: security and service records may reveal recurring user-related issues, such as repeated requests to reset authentication methods, unauthorised software installations or avoidable access-control exceptions.
• Assurance measures: internal audits, management reviews and evidence from compliance checks can show whether awareness requirements are embedded in business processes rather than treated as a separate activity.
• Qualitative measures: conversations with employees and managers can identify confusing procedures, conflicting business pressures or gaps between written policy and actual working practices.

These measures should be interpreted together. A high level of formal participation does not demonstrate that employees can apply the guidance under pressure. Conversely, an isolated mistake may indicate an unclear process rather than a lack of care or knowledge.

Measure outcomes, not just activity

Activity measures record what the organisation delivered, such as whether an awareness module was assigned or a policy was issued. They can be useful for administration, but they do not show whether risk has reduced. Outcome measures examine what changed afterwards: whether employees make the expected choice in a realistic situation, whether managers reinforce the correct process and whether the same type of error continues to appear.

A mature programme records both. Activity data confirms that the organisation has provided information; outcome data indicates whether that information has become usable behaviour. The second category is more valuable when deciding where further effort is needed.

Segment results by risk

Awareness should not be assessed only as one organisation-wide score. Different roles face different threats and responsibilities. Finance staff may need particular focus on payment fraud and approval controls. Administrators may require a deeper understanding of privileged access. Employees handling personal information need practical guidance on disclosure, storage and retention. People working across locations may face additional issues involving devices, networks and physical documents.

Segmenting results by role, access level, department or working arrangement helps identify targeted improvements. It also avoids treating employees as equally exposed when their responsibilities are materially different. Results should be used to improve controls and guidance, not to create simplistic rankings of individuals.

Establish a baseline and monitor direction

Measurement becomes more useful when the organisation records its starting position and uses consistent criteria over time. The baseline might include recurring audit observations, common policy questions, access-related exceptions and findings from reviews of business processes. Later results can then be compared with the same definitions and scope.

Trend information is generally more informative than a single result. A worsening pattern may indicate that procedures are too complicated, workloads are encouraging shortcuts, or new systems have introduced unfamiliar risks. An improvement in one area should not be assumed to represent improvement everywhere; awareness can vary substantially between teams and behaviours.

Connect findings to risk and corrective action

Results should be prioritised according to the potential business impact of the behaviour involved. A weakness affecting access to sensitive systems may require more urgent attention than a minor administrative inconsistency. The response could involve clearer instructions, a change to a technical control, revised approval steps, management reinforcement or role-specific guidance.

After action is taken, the organisation should check whether the underlying issue has been addressed. If the same problem persists, repeating the message alone may not be sufficient. The process, system design or allocation of responsibility may need to change.

Protect the integrity of the measurement process

Awareness measurement should be proportionate, transparent and handled with appropriate confidentiality. Employees should understand the purpose of the exercise, how results will be used and who can access individual-level information. Reporting should normally focus on themes, roles and risk patterns rather than publicising personal mistakes.

Measures should also be designed to avoid misleading conclusions. For example, a low number of recorded incidents might indicate strong awareness, but it could also mean that employees do not know how to raise concerns or do not trust the reporting process. Combining system evidence, management review and employee feedback helps distinguish between these possibilities.

An SME cyber security provider can help define measurable behaviours, map them to business risks, select suitable evidence and turn findings into a practical improvement plan. The objective is not to produce an impressive awareness score; it is to establish whether people can make safer decisions within the systems and processes the business uses every day.