Your quarterly human risk report is on one screen and the board meeting is in an hour. The report contains click rates, report rates and training completion — the numbers your security programme runs on — and the board will skim all of it in ninety seconds before asking the only question that matters: are we getting safer, and what do you need from us to keep it going?
Presenting human risk to a board is a translation exercise. Done well, it wins budget and keeps the programme funded. Done badly, it becomes a compliance line item nobody remembers by the next meeting. Here is how to structure it so the ninety seconds work in your favour.
TL;DR
- Lead with the trend, never the month. Directors fund direction, not snapshots.
- Use four numbers maximum: click rate, report rate, training completion, repeat clickers. Everything else is appendix.
- Translate every metric into a business sentence. 'Report rate doubled' becomes 'most real attacks would now be flagged by staff within the hour.'
- Never present individual names. Boards do not want them, and shaming data poisons the reporting culture the numbers depend on.
- End with one ask. A report without a decision request is a lecture.
What the board actually wants to know
Directors are not scoring your awareness programme. They are discharging three duties: understanding the organisation's material risks, confirming something is being done about them, and deciding whether the spend matches the exposure. A human risk report answers all three if it is framed as risk, not activity.
That means the opening slide should never be 'how many people completed training.' It should be a one-sentence risk position: where the human layer stood six months ago, where it stands now, and what still keeps it exposed. Everything after that slide is evidence for the sentence.
The good news is that human risk data is unusually board-friendly compared with most security metrics. It is expressed in percentages of people and time, not in log volumes or patch versions. A click rate falling from 22% to 6% over six months is a story any director can retell to their own board or an insurer.
The four numbers that belong in the pack
1. Click rate — and its trend line. Show the last six to twelve months on one line, not the latest month as a single figure. Context matters: a month where you rolled out harder templates and clicks ticked up 3 points is a sign the test is working, and the trend line is what shows that.
2. Report rate. This is the number most boards have never seen and the one that matters most. A reported email ends an incident that a click starts. If report rate is climbing while click rate falls, your culture is doing its job — say so explicitly, because it is the single best answer to 'are people actually changing behaviour?'
3. Training completion. Directors care about completion less as a metric and more as evidence the programme is administered. Present it as one number with the target: '96% completion this quarter against a 95% target.' If completion is 70%, present it with the reason and the fix, not as a bare number.
4. Repeat clickers. A small group of repeat clickers usually carries a disproportionate share of human-layer risk. Boards understand concentration risk instinctively from every other part of the business. Present the count and the intervention: role-targeted coaching, adjusted duties for payment approvals, or whatever the plan is.
If your platform produces a Human Risk Score, lead with its trend and put the four numbers underneath as the evidence. The score exists precisely for this room — human risk reporting shows how click, report and completion data roll up into one trend a director can follow quarter to quarter.
Translate every metric into a business sentence
| Metric | What you say | Why the board cares |
|---|---|---|
| Click rate 22% → 6% | 'Six months ago roughly one in five staff would have engaged with a real phishing email. Today it is closer to one in sixteen.' | Directors can picture their own workforce |
| Report rate 8% → 45% | 'Nearly half of suspicious emails are now flagged by staff before IT sees them.' | Faster containment, lower incident cost |
| Completion 96% | 'Training is finished and logged on time — the evidence trail auditors and insurers ask for is current.' | Regulatory and insurance readiness |
| 3 repeat clickers | 'Three people account for most of our residual human risk; they are in targeted coaching and two have been moved off payment approvals.' | Concentration risk being managed, not ignored |
The pattern in every row: state the movement, then state what it means for the business. A number without its sentence invites the board to invent their own meaning, and they will usually pick a more alarming one than the truth.
What to leave out
- Individual names and team shame lists. If a board member ever asks 'who clicked?', the answer is a count and a plan, never a name. Beyond the cultural damage, personal-level data in board minutes is a privacy problem of its own.
- Raw campaign counts. '412 emails sent, 96 opened, 41 clicked' forces the board to do arithmetic. Give them the percentage and the trend instead.
- Platform jargon. Nobody needs to hear 'auto-enrolment workflow' or 'template difficulty tiers' in a board pack. Describe what happens: 'anyone who clicks a test gets a ten-minute course that week.'
- Every metric the platform produces. Time-to-report and per-department breakdowns are appendix material. If a director wants depth, the appendix proves you have it.
The ask
End with exactly one request, stated in the same business language as the rest of the pack. Common ones:
- Renew or expand the platform — justified by the trend line: the programme is demonstrably working, and the marginal cost of continuing is small against the exposure it is reducing.
- Fund a gap assessment — when human risk is improving but the board asks about the technical layer, a structured cyber security gap assessment turns 'what else is out there?' into a prioritised, framework-mapped answer.
- Policy support — payment verification rules, MFA enforcement or reporting-time expectations that need the board's weight behind them.
One ask per meeting. Two asks means neither gets decided.
Handling the hard questions
'Clicks went up this month. Why?' Because you made the test harder — that is the whole point. Show the template change and the trend line on the same slide. A rising click rate on a harder test against a falling six-month trend is a programme working, not failing.
'Are these numbers any good?' Benchmarks vary too much by industry and template to quote an industry average honestly. Compare the organisation to its own six-month self, and note the direction. The follow-up question — 'where will we be in a year?' — is where you state the target: click rate under 5%, report rate above 50%, zero uncoached repeat clickers.
'What happens when someone clicks a real one?' Have the incident path ready in one sentence: report, contain, reset, learn — and note that the simulated programme has already rehearsed every step.
FAQ
How often should the board see human risk reporting? Quarterly is standard. Monthly is too granular for directors and makes normal variation look like a problem; six-monthly is too slow to catch a programme that has quietly stalled.
Should the full report go in the board papers or just the summary? Summary in the pack, full report available on request. Board papers travel widely; a document with per-team data in it should not.
What if the trend is bad — do we still present it? Yes, with the plan attached. A board that discovers a bad trend on its own will assume the worst; a board shown the trend, the cause and the fix becomes your ally for the resources the fix needs.
Is human risk reporting a substitute for technical reporting? No — it is one layer. Pair it with a technical posture view; the gap assessment report is the natural companion, and the two together answer the full 'where are we exposed?' question.