Security awareness training ROI is measured by trend in four numbers, not by a gut feeling: phishing click rate, report rate, training completion and repeat-clicker count. Set against an average self-reported cybercrime cost of $56,600 for an Australian small business (ASD, Annual Cyber Threat Report 2024–25), preventing one incident pays for years of programme spend.
TL;DR
- Four metrics carry the ROI case: click rate falling, report rate rising, completion stable, repeat clickers shrinking.
- Industry benchmark data shows untrained workforces click simulated phishing at roughly 33%, falling to 4.2% after twelve months of continuous training and testing.
- The strongest ROI signal is report rate climbing — a workforce that flags suspicious email is stopping attacks no filter caught.
- A single slide with two trend lines and one cost comparison makes the case; a forty-slide deck gets skimmed.
The problem with "ROI" on training
Spending on a firewall is easy to justify: something either got in or it didn't. Training is harder because its job is invisible — a staff member who spots a phishing email and deletes it generates no incident report, no ticket, no evidence.
That is exactly why a training programme needs its own instrumentation. The return on awareness training is not the absence of incidents; it is a measurable change in the behaviour that precedes incidents. Measure the behaviour, and the return shows up as a trend line.
The four numbers that carry the ROI case
| Metric | What it measures | Direction that signals ROI |
|---|---|---|
| Phishing click rate | How often staff engage with simulated lures | Falling month over month |
| Report rate | How often staff flag suspicious email unprompted | Rising |
| Training completion | Whether assigned modules finish on time | Stable and high |
| Repeat clickers | Staff who clicked in two or more consecutive campaigns | Shrinking list |
Click rate is the number everyone quotes, and it is the least interesting on its own. The real ROI story is the pair: clicks falling while reports rise means staff are not just avoiding mistakes — they are actively defending the inbox.
The benchmark that makes the case externally
KnowBe4's 2026 Phishing by Industry Benchmarking Report — built from 67.7 million simulated phishing tests across 14.5 million users — puts global phishing susceptibility at 33.2% before any training, 20.1% after 90 days, and 4.2% after twelve months of continuous training and testing. That is an 87% reduction over a year.
Those figures give you two things for the ROI conversation: a baseline you can compare your own numbers against, and external evidence that the trend you are seeing is the trend the industry sees when a programme is run properly.
The cost side of the equation
Platform spend for a small team is modest — see the budget breakdown for real ranges. Against that:
- ASD's Annual Cyber Threat Report 2024–25 puts the average self-reported cost of a cybercrime incident to an Australian small business at $56,600, up 14% year on year.
- The attacks that reach that cost usually start with a human decision — a clicked link, an approved MFA prompt, an invoice paid to a changed bank account.
- Preventing one such incident covers several years of programme spend on its own.
That comparison — programme cost against single-incident cost — is the honest ROI frame. It does not require attributing a specific avoided breach to training; it requires showing that the behaviour driving that breach class is measurably changing.
How to present ROI internally
For a manager or board, the pitch fits on one slide:
- Where we started. Click rate on campaign one, report rate, completion rate.
- Where we are. Same three numbers, most recent campaign.
- What it cost. Platform spend and admin hours for the period.
- What it prevents. One sentence: the average incident this defends against costs $56,600; we spent a fraction of that.
Human risk reporting platforms generate the first two bullets automatically; the last two are yours to write. Keeping it to one slide matters — a 40-slide ROI deck gets skimmed, a single trend line gets read.
What ROI is not
- Not a completion percentage. Everyone finishing a module says nothing about whether they would click a real lure.
- Not a single good campaign. One low click rate on an easy template is noise.
- Not a compliance checkbox. Meeting a framework requirement is a benefit of the programme, not its return.
FAQ
How long before training shows measurable ROI? Click-rate improvement is usually visible within two to three monthly campaigns. The full benchmark reduction — from roughly 33% to 4.2% — takes about twelve months of continuous cadence.
What is the single best ROI metric? Report rate. It measures the proactive behaviour that stops attacks filters miss, and it is the metric least affected by lure difficulty.
Can we tie ROI to a specific avoided incident? Occasionally — a staff member reports a real phishing email and you can see what it was targeting. Treat those as anecdotes that support the trend, not as the ROI case itself.
Does ROI differ for small vs large teams? The metrics are the same. Small teams reach statistical significance faster on per-person trends but see more variance campaign to campaign — read the trend over three months, not one.
Should we include simulation results in an insurance submission? Yes. Insurers increasingly ask for evidence of ongoing training and testing; a click-rate trend plus completion records is exactly what they are looking for.
One last thing
The ROI question is usually asked by someone who has never seen a phishing click-rate trend. Show them two lines — clicks falling, reports rising — and the annual cost next to the average incident cost, and the argument makes itself.