Boards are asking tougher questions about security awareness budgets. UK organisations face persistent phishing, business email compromise and invoice fraud, yet many CISOs and IT leaders struggle to evidence that training is reducing real risk. This guide sets out a practical, defensible framework to measure security awareness ROI and show clear reductions in social engineering incidents that resonate with finance and the board.
What security awareness ROI really means
ROI for security awareness is not about quiz scores or attendance. It is about measurable reductions in the likelihood and impact of social engineering attacks that would otherwise lead to incidents, losses and regulatory exposure. A simple, board-ready formula is:
ROI = (Avoided incident cost attributable to the programme − Programme cost) ÷ Programme cost
To make that credible, you need the right KPIs, baselines, simulation data, and a cost model aligned to your sector and risk appetite.
Step 1: Establish your baseline
Before any new campaign, capture at least 6 to 12 months of relevant data. Use existing SIEM, mailbox abuse reporting and incident tickets to assemble a clean baseline. Consider a structured risk assessment to ensure completeness.
Baseline data to collect:
- Volume and rate of phishing emails reaching users, plus the percentage reported to security.
- Click-through and credential submission rates from any past simulations.
- Confirmed social engineering incidents by type, for example BEC, invoice fraud, helpdesk pretexting.
- Mean time to report suspicious emails and mean time to respond or contain by security.
- Financial impact of past incidents, including direct costs and downtime.
For UK context and benchmarking, note that the NCSC’s Suspicious Email Reporting Service encouraged large-scale reporting and takedowns, underlining the value of quick user reporting and coordinated response. See the NCSC Annual Review 2020 for UK-scale statistics and initiatives CISOs can reference in board discussions.
Step 2: Define KPIs that reflect real risk reduction
Select KPIs that you can measure consistently and that the board will recognise as drivers of business and regulatory risk.
Core behaviour metrics:
- Phish-prone rate: percentage of users who click within a defined window.
- Credential submission rate: percentage entering credentials after clicking.
- Report rate: percentage of users who correctly report simulated phishing.
- Time to report: median minutes from delivery to first user report.
- Repeat offender rate: percentage of users who fail simulations more than once per quarter.
Outcome and control metrics:
- Confirmed social engineering incidents per quarter and near-miss count.
- Mean time to respond and contain for phishing-derived incidents.
- Adoption of secure controls that blunt social engineering, for example multi-factor authentication rollout to high-risk roles.
- Exposure indicators, such as appearance of corporate credentials on the dark web following campaigns, supported by dark web monitoring.
Difficulty weighting for simulations: not all phishing emails are equal. To keep results comparable over time, apply a difficulty score to each template. NIST’s research on categorising human phishing difficulty offers a structured way to rate cues and deception complexity. Weighting ensures that a drop in click rate reflects better behaviour, not just easier scenarios.
Step 3: Design your measurement plan
Pair education with evidence. Plan a 12-month cadence that blends short, contextual learning with routine simulations and operational metrics.
- Quarterly phishing runs with escalating difficulty and clear feedback loops, delivered through controlled social engineering testing.
- Targeted micro-learning for high-risk functions such as finance, procurement and helpdesk, supported by formal cyber security awareness training.
- Operational telemetry from your SOC SIEM and mailbox reporting add-in, integrated into monthly KPI dashboards.
- Runbooks to capture time-to-report and time-to-respond for every simulation and genuine phishing event.
Ethics and trust matter. Avoid punitive naming-and-shaming. Focus on fast feedback, supportive coaching and clear reporting mechanisms.
Step 4: Build a sector-aware cost model
Translate reduced incidents into avoided costs that the board recognises. Break each social engineering incident into direct, indirect and regulatory components:
- Direct: security and incident response hours, forensics, legal, external comms.
- Indirect: downtime and lost productivity, service credits, customer support load, reputational damage leading to churn.
- Regulatory: investigation and remediation costs associated with UK GDPR accountability and NIS obligations, and potential enforcement exposure.
Indicative approach to cost per incident:
- Response cost = hours to contain and recover × blended hourly rate.
- Downtime cost = affected staff × hours disrupted × productivity rate or revenue-at-risk per hour.
- Customer impact cost = complaints handling hours × rate + goodwill gestures.
Sector considerations:
- Healthcare: patient safety and service disruption multipliers. Use critical function restoration time as a key driver.
- Financial services: fraud loss exposure, regulatory scrutiny and customer churn weightings.
- Retail and logistics: fulfilment delays and supply chain penalties. Measure missed SLAs and chargebacks.
- Manufacturing and maritime: operational downtime and safety factors.
Document your assumptions, sources and confidence intervals. Start conservative, then refine with real data as your programme matures.
Worked example: making the ROI case
Assume a 1,000-user UK organisation.
- Baseline per quarter: 4 social engineering incidents leading to containment work, average cost £18,000 each. Total baseline cost £72,000 per quarter.
- Programme investment: £45,000 per year for simulations, awareness content, and measurement. Quarterly cost £11,250.
- After two quarters: phish-prone rate falls from 14 percent to 6 percent. Report rate rises from 18 percent to 62 percent. Confirmed incidents drop to 1 per quarter. Average cost per incident also falls to £12,000 due to faster reporting and response.
Quarterly avoided cost = £72,000 − £12,000 = £60,000. Quarterly ROI = (£60,000 − £11,250) ÷ £11,250 = 4.33, or 433 percent.
Strengthen the case by attributing improvements to specific drivers. For example, time to first user report improved from 5 hours to 18 minutes after deploying a report button and coaching. That allowed the SOC to block domain and revoke tokens swiftly, halving response hours.
Step 5: Report in a board-ready format
Structure the pack so that non-technical leaders can see the trend, the outcome and the financial implication at a glance.
Recommended sections:
- Headline outcomes: incidents per quarter, avoided cost, ROI this quarter and year to date.
- Behaviour trends: phish-prone, credential submission, report rate, time to report.
- Operational trends: time to respond and contain, repeat offender rate, high-risk department spotlight.
- Control improvements: MFA coverage in finance, supplier verification policy adoption, mailbox reporting rollout.
- Next quarter plan: targeted simulations, supplier training, executive coaching, and metrics forecast.
Map KPIs to recognised frameworks to reinforce credibility. The NIST Cybersecurity Framework provides useful categories to align measurement, such as Detect, Respond and Recover. This helps show how behaviour change supports resilience, not just awareness for its own sake.
Align with UK guidance and expectations
When presenting to UK boards, reference the NCSC’s practical emphasis on reporting and rehearsals. The NCSC’s 2020 review highlights national-scale outcomes from user reporting and simulated exercises, reinforcing that these KPIs are proven levers. For privacy governance, the ICO’s Accountability Framework expects demonstrable staff awareness and continuous improvement. NHS organisations can draw on the Cyber Security Toolkit for sector baselines and assurance reporting. These references show your programme supports compliance and resilience, not only cost avoidance.
Operationalise measurement across technology and people
Measurement is sustained by tooling and process integration:
- Integrate phishing simulation events with your managed detection and response tooling for uniform time-to-detect and time-to-respond metrics.
- Route reports via mailbox add-ins to your SOC SIEM queue with unique identifiers to distinguish simulations from real campaigns, ensuring apples-to-apples comparisons.
- Track credential exposures and supplier impersonation attempts over time using dark web monitoring, correlating reductions with behaviour improvements and MFA coverage.
- Use playbooks to capture consistent data fields for every incident, including source, vector, staff action, time stamps and cost components.
A lightweight, repeatable template
Set up a quarterly cadence as follows:
- Baseline refresh: update KPI time series and validate outliers.
- Run two to three difficulty-weighted simulations and one role-specific scenario.
- Deliver micro-learning and executive briefings targeted at observed gaps.
- Calculate avoided cost with conservative assumptions. Peer review the calculations with finance.
- Publish a 2-page board dashboard with traffic light status and a one-page appendix covering assumptions and data sources.
Common pitfalls to avoid
- Focusing on vanity metrics. Training completion without behaviour change will not convince the board.
- Changing simulation difficulty without re-weighting. Maintain comparability using difficulty scores informed by NIST research.
- Ignoring process and control fixes. Pair awareness with policy updates, supplier verification and multi-factor authentication to translate behaviour into risk reduction.
- Over-claiming attribution. Use conservative avoided-cost estimates and document assumptions.
Where Samurai Security can help
If you need a fast start, we can provide a tailored measurement and improvement package that includes:
- Baseline and maturity review aligned to board priorities, delivered as a concise cyber breach risk assessment.
- Difficulty-weighted phishing simulations and analytics through our social engineering testing service.
- Role-specific cyber security awareness training for finance, IT and frontline staff.
- Operational integration with your SOC SIEM and managed detection and response for ongoing measurement.
Security awareness investments must compete with other priorities. With the right metrics, weighting and cost model, you can demonstrate material reductions in social engineering risk and deliver a transparent ROI that earns continued board support.