How to Measure Security Culture in an Organisation?

Consider two companies with the same firewalls, the same endpoint protection and the same annual training module. One suffers a breach because an employee clicked a convincing link and stayed quiet about it. The other stops the same attack in minutes because a colleague spotted it and reported it straight away.

The technology was identical.The difference was culture.

Understanding Security Culture: The Human Layer of Defense

An organization’s security culture begins with its employees. While technologies, policies, and processes provide essential safeguards, employees remain the organization’s human layer of defense. They take part in all aspects of business operations, and their decisions have a direct effect on the ways in which the organization protects its systems, data, and assets.

What employees think about security, how much they value it, and how consistently they follow secure practises are all important. Every action they take - ranging from handling sensitive information and responding to suspicious emails to reporting potential risks - impacts the organization’s overall security posture.

However, security culture is not created by individual actions alone. Over time, employees’ behaviours, attitudes, and decisions begin to influence those around them. They notice what is encouraged, what is ignored, and what is considered acceptable in the workplace. These recurring patterns gradually become shared practices across teams and departments.

These shared values, attitudes, norms, and behaviours that influence how employees collectively protect the organization’s systems, data, and assets is what is called 'security culture'.

Simply put, it is the way people think about and act on security everyday - often when no one is watching. It is reflected not only in what employees know, but in the choices they make and the actions they take as part of their daily work.

If the human element of the defence system is strong, then employees will take an active role in securing the organisation, helping to lower risks and improve its resilience. But if it is weak, even the most advanced security technologies and controls can be undermined by a single unsafe decision, such as clicking a malicious link or failing to report a concern. 

So, the next important question is: 

How do you know whether your organization’s human layer of defense is strong? 

The answer is by measuring it.

Security culture is not something you build once and forget. It needs continuous improvement, and you cannot improve what you do not understand. Before you can strengthen it, you need visibility into your current state: how employees think, how they behave and which security practices they follow.

Measuring security culture helps organizations move beyond assumptions and gain visibility into how employees actually think, behave, and respond to security in their daily work. It reveals strengths, identifies areas of improvement, and provides insights needed to build a stronger security culture.

Many organisations lean on 'training completion rates' as their proof of a healthy culture. A 100% completion rate only tells you that people clicked through the slides. It does not tell you whether they can spot a phishing email, whether they would report one, or whether they think security is their job at all.

This is where cybersecurity metrics come in. They give you evidence on whether your culture is improving or needs attention, so you are not relying on gut feeling or a compliance checkbox.

What Should Organisations Measure to Understand Security Culture?

Before choosing metrics, it helps to know which dimensions of culture you are trying to understand. Four questions cover most of the ground:

• Security awareness and knowledge: Do people understand what secure behaviour looks like?
• Security attitudes and perceptions: Do people value security, and do they believe they have a role to play?
• Security behaviours: Are people applying secure practices in real life situations?
• Security engagement and participation: Are employees actively engaging with security?

Knowing something, believing in it, doing it and championing it are four different things. A healthy security culture needs all four, and each one can fail independently. An employee may know the rules, yet think security is "IT's problem" and never act on them.

Metrics That Help Measure Security Culture

No single number can capture something as human as culture. A combination of knowledge, behaviour and outcome-based metrics gives a far more accurate picture than any one measurement alone. Here is a practical way to group them.

1. Awareness metrics

These show what people know.

• Training completion rate
• Assessment scores

These are a useful baseline but treat them as the starting point. They tell you employees were exposed to the material, not that it changed anything.

2. Behaviour metrics

These show what people do.

• Phishing click rate: How many employees fall for simulated attacks?
• Phishing reporting rate: How many report the suspicious email? This is often more telling than the click rate, because it shows active defence rather than just avoided mistakes.
• Repeat risky behaviours: Are the same people or teams making the same errors repeatedly? That pattern usually points to a gap in guidance, tooling or motivation, not simply carelessness.

3. Culture metrics

These show what people think and feel.

• Employee survey results: Well-designed surveys reveal attitudes, perceptions and blind spots that behavioural data cannot.
• Security confidence scores: Do employees feel equipped to make good decisions?
• Reporting culture indicators: Do people feel safe admitting mistakes? If reporting an error means blame, people will hide errors, and hidden errors are the most dangerous kind.

4. Outcome metrics

These show the real-world results.

• Reduction in security incidents
• Faster incident reporting
• Improved compliance with security practices

Outcome metrics connect culture to business impact, which makes them useful for justifying investment to leadership. Faster incident reporting is a particularly good sign, because it means people are alert, confident and willing to raise their hand.

Read together, these categories tell a story. If training scores are high but phishing reports are low, people know what to do but are not acting on it. If the surveys show low confidence and you also see repeat risky behaviours, the problem may lie in the processes, not the people.

Turning Measurement into Improvement

The fact that many organisations fail to realise is that measurement is not the end of the process; a dashboard filled with metrics which no one takes any action on is no more than ornamental. The purpose is to generate insights that help you strengthen culture continuously. A practical cycle works in the following way:

• Divide the data by department, region, role, or behaviour. Find the weak points and look for patterns. Averages conceal problems, so consider segmenting your data for clearer insights.
• Offer targeted interventions; if a particular team has problems with password hygiene, then direct your efforts towards that team rather than organising another session for the whole organisation.
• Improve security processes. If employees keep bypassing a control, ask whether the control is too cumbersome. In some cases, the solution is to alter the process rather than provide more training.
• Provide guidance that is specific to each role. Since finance teams are vulnerable to invoice fraud, HR teams deal with personal data that is sensitive, and developers are responsible for managing code and credentials, each group should receive advice that matches the nature of their everyday tasks.
• Reinforce positive behaviours. Recognise the employee who reported a phishing attempt. Recognising good behaviour spreads it faster than penalising bad behaviour.
• Keep a continuous record of progress. Take further measurements and compare them. Since cultural change is gradual, it is more important to look at trends over quarters than at a single point in time.

Final Thoughts

Security culture is not only one of the best defences that an organisation can have but also one of the most difficult to maintain. By measuring employees' awareness, attitudes, behaviours and engagement, and by combining awareness, behaviour, culture and outcome metrics, you will be able to convert something intangible into one that can be understood and improved.

Begin on a small scale by selecting one metric from each category, setting up a baseline and acting based on what you find out. As time goes on, your employees will cease to be viewed as the weakest link and will instead become what they are capable of: your most valuable security asset.