Present human risk reporting to the board with three numbers and one trend: the company's human risk score this quarter against last, the phishing click and report rates, and training completion — each benchmarked against the platform's anonymised peer data. The board does not want a thirty-slide security deep dive; it wants to know whether the biggest source of breaches (people clicking things) is getting better, what it costs, and what happens if it keeps improving. A one-page scorecard that answers those three questions gets budget approved; a dashboard dump gets filed.
TL;DR
- Lead with the trend: risk score, click rate and report rate this quarter versus last.
- Benchmark everything — boards calibrate 'is 8% clicks bad?' against peers, not absolutes.
- Translate the human layer into money: average breach cost, insurance posture, and what the programme costs to run.
- Name the next quarter's single focus in one sentence, with an owner and a date.
- Never present a raw tool screenshot; present the scorecard, keep the tool in the appendix.
Why the board cares about human risk in the first place
The human layer is where breaches start. Roughly 60% of data breaches involve a human element — an error, a clicked link or a manipulated employee (Verizon, 2025 DBIR). For Australian businesses the financial stakes are specific: the average self-reported cost of cybercrime to a small business is $56,571 per incident, up 14% year on year, and business email compromise is among the top self-reported threats (ASD, Annual Cyber Threat Report 2024-25).
Every one of those incidents travels through a person. That is why the board's oversight question is not 'which firewall did we buy' but 'is our workforce getting harder to phish, quarter on quarter?' Human risk reporting is the instrument that answers it — and human risk reporting exists precisely to turn simulation and training data into numbers a non-technical director can act on.
The one-page scorecard: what goes on it
Five rows, no more. Anything else belongs in an appendix the directors can read after the meeting.
| Metric | What it answers | Board-ready form |
|---|---|---|
| Human risk score | Are we safer than last quarter? | One number, trend arrow, peer benchmark |
| Phishing click rate | How many people would have been compromised? | % this quarter vs last, split easy/hard lures |
| Report rate | Is the reporting culture forming? | % of simulations reported, trend over 6 months |
| Training completion | Are we compliant with our own programme? | % complete by due date, overdue count |
| Repeat clickers | Where is the concentrated risk? | Count (and department split if large) |
The score is the headline because it compresses the story: a risk score that fell from 68 to 52 in two quarters tells a director more than any matrix. The report rate is the sleeper metric — click rate measures the phishing, but report rate measures the culture, and it is the one that catches real attacks before they land.
Benchmark before you present
The first question every board asks about a human risk number is 'good compared to what?' Answer it before the meeting:
- Peer data. Most human risk platforms provide anonymised industry or size benchmarks. A 6% click rate against a 9% peer average reads as progress; the same 6% against a 3% average reads as a problem.
- Your own baseline. The first simulation ever run is the baseline. If the baseline was 22% clicks and today is 6%, that trajectory is the story.
- Insurance and contract context. Some cyber insurers and enterprise clients now ask for evidence of awareness programmes at renewal. The scorecard doubles as that evidence pack.
If the platform cannot produce benchmarks, present the trend alone and say so plainly — a trend without a benchmark is still a defensible board metric; an unbenchmarked single number is not.
Translate the numbers into money and exposure
Boards approve budget, not metrics. Each metric on the scorecard should carry one line of business translation:
- Click rate down means fewer stolen credentials, which means fewer business email compromise payouts and less likelihood of an insurer declining a claim for want of staff controls.
- Report rate up means incidents surface in minutes rather than weeks — the difference between blocking a domain and recovering stolen funds.
- Completion up and repeat clickers down means the programme is working as designed and the next renewal conversation with the insurer or a client's security questionnaire gets easier.
When you need budget, run the arithmetic openly: programme cost per employee per year against the average incident cost, and state that one prevented business email compromise pays for the programme several times over. The guide to building a security awareness training budget for the board walks the full arithmetic; for governance framing, the training for board directors comparison shows what directors themselves are being trained on.
The 10-minute structure that works
- Trend first (2 minutes). One slide: risk score, click rate, report rate — this quarter, last quarter, baseline. Say the direction out loud.
- What drove it (3 minutes). The two or three things that moved the numbers: a new simulation template that spiked clicks, an onboarding cohort that completed early, a department with repeat clickers.
- Benchmark and exposure (2 minutes). Peer comparison, insurance/contract posture, residual risk in plain terms.
- The ask (2 minutes). One decision: continue, expand to a new team, fund a specific gap. With a cost and an owner.
- Questions (1 minute, plus the appendix). Everything else lives behind the scorecard.
What the board should never see is the tool. Screenshots of simulation dashboards invite line-by-line interrogation of template names and dates; the scorecard invites decisions.
Common failure modes
- Presenting 40 slides. Depth reads as evasion to a director with 6 minutes of agenda time.
- Reporting only successes. A quarter where click rate rose after switching to harder lures is a better board story than a flat vanity number — the harder-lure decision shows the programme is being tuned, not coasted.
- Reporting once a year. A quarterly rhythm is what makes the trend credible; an annual report has no trend to show.
- Unowned actions. Every follow-up on the scorecard needs a name and a date, or the board learns the report is decorative.
- Mixing frameworks. If the security team also reports a gap assessment, keep the two documents consistent — the human-risk rows of the gap assessment should match the scorecard, or the board will spot the discrepancy.
FAQ
How often should human risk be reported to the board? Quarterly. Monthly is too granular for most boards and annual loses the trend; quarterly lines up with audit and insurance cycles.
What if our click rate went up this quarter? Present it with its cause. A rise after switching to harder simulation templates is the programme maturing; a rise on unchanged templates is a real finding that needs an owner. Either way, name the action being taken.
Should individual employees be named in board papers? No. Report repeat clickers as a count with a department split at most. Naming individuals in board material creates privacy and employment risk and undermines the no-blame reporting culture that makes the programme work.
What number is the single most important one? The report rate. Click rate measures how many people were fooled by a controlled test; report rate measures how many people would flag a real attack — and real attacks are reported by humans far more often than they are caught by tools.
How does this connect to the rest of our security reporting? As one page of a wider pack. The human layer scorecard sits alongside technical metrics (patching, backups, MFA coverage) and, ideally, inherits its baseline from the same gap assessment the security team uses.
One last thing
The scorecard earns its place on the board agenda the quarter the directors start quoting it back. That happens when the same three numbers appear every quarter, in the same order, with the trend arrows — and when the ask on the last slide connects to a number on the first.