A client asks how their human risk trend is moving and the platform answers in one click with a branded PDF - but a partner who runs quarterly reviews in Power BI wants the same numbers sitting beside every other metric they report on. Exporting Cyber Aware training data into Power BI is a build-it-yourself job: the platform exposes a direct API and Zapier, and Power BI consumes both through Power Query.
TL;DR
- Cyber Aware has no native Power BI connector - the published integration list covers Google Workspace, Microsoft 365, Zapier and a direct API.
- Two supported routes: Power Query's Web connector against the Cyber Aware API, or Zapier landing the data in a store Power BI already reads.
- The three datasets worth exporting first: Human Risk Scores, course completion and phishing results.
- Scheduled refresh in Power BI Service needs a working credential path - decide that before the first dashboard, not after.
- Build one client's dashboard, prove it reconciles with the portal PDF, then template across the portfolio.
Why this matters
The human risk reporting suite already answers the audit question inside the portal: six admin dashboards, filterable by course, learner and completion status, with branded PDF exports per client. What it does not do is sit in your own BI stack next to ticket volumes, patch compliance and revenue. That is where Power BI earns its keep - one page a partner or board can read, built from the same numbers the training portal computes.
There is no native Power BI app in Cyber Aware's published integration list. That is not a blocker. The platform exposes both a webhook and a direct API, and Power BI's Power Query engine is built to consume exactly that: an HTTP endpoint returning JSON, pulled on a refresh schedule you control.
Who this is for
Two audiences. First, MSPs who present client QBRs in Power BI and want training and phishing data on the same page as everything else they manage. Second, internal IT and security teams who report to a CISO or board through a standard BI stack and want training compliance treated like any other control.
Before you start
- API or Zapier access on the Cyber Aware side. The direct API is the cleaner path for Power BI; Zapier works when you would rather stage the data somewhere Power BI already reads, like SharePoint or Google Sheets.
- Power BI Desktop for the build, plus a workspace in Power BI Service for scheduled refresh.
- A per-client scope decision. Decide whether each dataset pulls one client tenant or the whole portfolio - mixing both in one dataset is the mistake that is hardest to unwind later.
- The gotcha: scheduled refresh needs a credential path that works unattended. A refresh that runs fine on your laptop fails the moment it is scheduled, because the gateway or token expired. Prove the refresh path before building visuals.
Step 1 - Pull the training data
- Identify the three datasets that answer real questions: Human Risk Scores per learner, course completion status, and phishing simulation results.
- Point Power Query's Web connector at the Cyber Aware API endpoint for each dataset, with the API key in the header.
- Run one manual refresh per source and confirm rows arrive for a client you know - a named tenant with learners you can count.
Expected result: three tables in Power BI Desktop, each populated for one test client.
Step 2 - Shape it in Power Query
- Normalise emails to lowercase so learner records join cleanly across datasets.
- Add a month column if the payload carries per-event dates - the trend is the story, not the snapshot.
- Keep the raw payload columns in a staging query and shape a clean presentation layer on top. When the API adds a field, only the staging query changes.
Expected result: one clean table per dataset, with a date column every visual can filter on.
Step 3 - Model the risk trend
- Build the headline visual first: average Human Risk Score per client, trended by month, lower is better.
- Add completion rate and phishing click rate as supporting cards so the score has context - a score of 6 reads differently next to a 40% completion rate.
- Mirror the portal's own bands if you want the two views to reconcile: low, moderate and high, with the same thresholds the platform uses.
Expected result: a one-page dashboard where the number the client sees in the branded PDF and the number in Power BI match.
Step 4 - Publish and schedule refresh
- Publish to a Power BI Service workspace with access limited to the people who should see learner-level risk data.
- Configure scheduled refresh and run it once while watching - the first scheduled run is where credential problems surface.
- Reconcile the refreshed numbers against the portal's own export for the same period. If they disagree, fix the model before the first QBR, not during it.
Expected result: a dashboard that updates itself and matches the portal within the same reporting month.
Troubleshooting
- Refresh fails with a credentials error. The token or gateway path broke. Re-enter the credential and check whether the API key expires on a schedule you did not plan for.
- Numbers do not match the portal PDF. The two views cut the month differently - refresh time versus reporting period. Align the date filter before blaming the data.
- Duplicate learner rows. Case differences in emails or a re-pull of the same period. Normalise emails and de-duplicate on the natural key, not on row count.
- Client B's data in client A's report. The dataset is scoped portfolio-wide and the visual is missing its client filter. Scope at the query level, not the visual level.
- Nothing loads at all. Test the endpoint outside Power BI first - if the API call fails in a browser or curl, the problem is the request, not Power BI.
What to do next
The dashboards are only as good as the programme behind them. Security awareness training runs the monthly cadence that feeds the scores, and phishing simulations supply the behavioural half. Partners still choosing a platform to standardise on can compare integration depth across vendors in the white-label platform comparison before committing to a reporting stack.
FAQ
Does Cyber Aware have a native Power BI integration?
No. The published integration list covers Google Workspace, Microsoft 365, Zapier and a direct API. The Power BI route is Power Query against the API, or Zapier staging the data somewhere Power BI reads.
Which data should I export first?
Human Risk Scores, course completion and phishing results. Those three answer who needs help, who is done and who clicked - the questions every QBR asks.
Can Power BI refresh on a schedule?
Yes, once the credential path works unattended. Build the refresh connection in Power BI Desktop, publish, then prove the first scheduled run before building visuals on top of it.
Does the API expose per-client scoping?
Scope each dataset to one client tenant and keep portfolio roll-ups in a separate model. Mixing scopes in one dataset is the mistake that is hardest to unwind.
Will the Power BI numbers match the branded PDF exports?
They should, for the same reporting month. If they differ, the usual cause is a different cut-off - the PDF reports a period, Power BI reports up to the refresh time.
Is learner-level data safe in Power BI?
Only if access is controlled. Publish to a restricted workspace; the learner dashboard in the portal keeps scores private per person, and your BI workspace should honour the same principle.
One last thing
Reconcile before the first QBR. A partner who discovers mid-meeting that Power BI and the portal disagree loses the room - and the fix is a date filter, not a rebuild.