Presenting human risk reporting to leadership works with a one-page monthly brief built on three numbers: click rate, report rate and training completion, each shown as a trend with last month's value, this month's value and the twelve-month line. Anything more and the brief stops being read; anything less and leadership is asked to trust a number with no context. This page gives the exact structure of that brief, the words to use for each chart, and the three questions leadership always asks.
TL;DR
- One page, three numbers: click rate, report rate, training completion — each as a trend.
- Show the twelve-month line, not the single month; a one-month number is a data point, the line is the verdict.
- Pair every dip with the reason (harder lure batch, holiday month) before leadership asks.
- Lead with report rate: it is the metric that measures the reflex that catches real attacks.
- Close with one ask — budget, time or a policy change — never a status update alone.
The one-page structure
A monthly leadership brief has five sections, top to bottom:
- The headline number. One sentence: 'Click rate fell from 11% to 8%; report rate rose to 52%.' Leadership reads this line; everything below is evidence for it.
- The trend lines. Click rate, report rate and completion, each over twelve months. Three lines, one chart per metric, no combined 'risk score' that needs explaining.
- What changed. Two or three bullets: harder campaign, new starters, a department that improved.
- Who needs coaching. Named at the per-person level but anonymised in the brief itself; the list is for the manager, not the boardroom.
- The ask. Time, budget, or a policy decision. A brief without an ask is a status report, and status reports stop getting read by month three.
The words to use for each number
Numbers alone do not survive a leadership meeting; framing does. Use these pairings:
- Click rate — 'one in twelve staff interacted with a simulated attack this month, down from one in nine last month.' The ratio form sticks better than the percentage.
- Report rate — 'more than half of staff now report suspicious email unprompted, up from one in five when we started.' This is the metric that protects the business when a real attack gets past the filters.
- Training completion — '94% completed this month's module on time' followed immediately by the follow-up for the 6%.
- Repeat clickers — 'three people drove most of this month's clicks; each has targeted coaching scheduled.' Naming the count without naming people keeps the brief safe to circulate.
Benchmark context helps when leadership is new to the programme: untrained workforces click simulated phishing at 33.2%, falling to 4.2% after twelve months of continuous training (KnowBe4, 2026 Phishing by Industry Benchmarking Report). Your trend line read against that curve turns 'are we doing well?' into 'we are tracking to the known improvement curve.'
The three questions leadership always asks
| Question | The answer to prepare | The evidence to have ready |
|---|---|---|
| 'Is this actually reducing risk?' | Yes — click trend against the industry curve, report rate rising | Twelve-month trend chart and the benchmark overlay |
| 'What happens when someone clicks?' | Immediate targeted training, same week, no blame | The auto-enrolment rule and last month's follow-up count |
| 'Are we compliant?' | Training records map to Essential Eight / SMB1001 evidence | The export the assessor receives |
Prepare all three answers in the brief itself and the meeting shortens to minutes.
Common mistakes that kill the briefing
- Reporting every campaign as a fresh event. Leadership reads twelve independent numbers instead of one trend; the verdict never forms.
- Using the platform's full export. Ten pages of detail is the analyst's job, not the boardroom's. One page, appendix optional.
- Presenting a dip without context. A harder lure batch legitimately drops click performance; say so in the same breath or the room concludes the programme failed.
- No ask. A brief that asks nothing trains leadership to treat security as an FYI, and the budget conversation never opens.
How the numbers get produced
None of this brief is hand-built: click, report and completion metrics roll out of the simulation and training platform automatically. Cyber Aware's human risk reporting generates the per-person and per-organisation dashboards the one-pager draws from, and phishing simulations feed it after every campaign. The evidence export for an assessor comes from the same records — see how a security gap assessment uses them.
FAQ
How often should human risk be reported to leadership? Monthly. Quarterly is the floor; weekly invites overreaction to a single difficult campaign.
Should per-person data appear in the leadership brief? Not by name. Counts ('three repeat clickers') yes, names no — names belong in the manager's coaching view, and anonymising keeps the brief safe to circulate.
What is the single number that matters most? Report rate. Clicks measure mistakes; reports measure the reflex that neutralises the real attack that gets past every filter.
What if the numbers look bad one month? Present them with the reason. A deliberately harder campaign is a programme working, not failing — and leadership trusts a brief that explains its own dips.
One last thing
The brief that survives month twelve is the one that fits on a page, opens with the trend, and asks for something. Everything else is detail for the person running the programme.