Security Awareness Coverage Calculator

coverage = (0.28×completion + 0.22×roleSpecific + 0.30×behaviourChange + 0.20×cadence) × scopeAdjustment, where behaviourChange combines click-rate reduction and the report-to-click ratio. Completion is necessary and nearly meaningless on its own, so measured behaviour carries the largest single weight: whether clicking went down and whether reporting went up. Role-specific training is scored separately because the attacks aimed at finance, developers and executives have nothing in common with a generic module. Excluding contractors caps the score, since they typically hold equivalent access.

A 98% completion rate with an unchanged click rate means you have documented training, not changed behaviour — and only one of those affects an incident.

This calculator takes 9 inputs: People in scope, Completed the annual module, Contractors and third parties included, People in high-risk roles, High-risk roles with role-specific training, Phishing simulations per year, Click rate at programme start, Click rate now, Report rate now. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Yes, and mature programmes exceed 2. It comes from making reporting a single button, acknowledging every report, and never penalising a false report — people stop reporting the moment it feels risky or tedious.

Punitive approaches reliably reduce reporting, which is worse than the clicks. Use extra coaching for repeat clickers and reserve formal process for wilful policy breaches rather than falling for a well-crafted lure.