Skip to content
ENExplore Calculators

Security Awareness Coverage Calculator

Score awareness programme coverage from completion rates, role-specific training, simulation cadence and behaviour change.

About Security Awareness Coverage Calculator

Completion is necessary and nearly meaningless on its own, so measured behaviour carries the largest single weight: whether clicking went down and whether reporting went up. Role-specific training is scored separately because the attacks aimed at finance, developers and executives have nothing in common with a generic module. Excluding contractors caps the score, since they typically hold equivalent access. A 98% completion rate with an unchanged click rate means you have documented training, not changed behaviour — and only one of those affects an incident.

Formula

Security Awareness Coverage

coverage = (0.28×completion + 0.22×roleSpecific + 0.30×behaviourChange + 0.20×cadence) × scopeAdjustment, where behaviourChange combines click-rate reduction and the report-to-click ratio.

completion
Share of in-scope people who finished the module
roleSpecific
High-risk roles receiving targeted content
behaviourChange
Measured improvement in click and report rates
scopeAdjustment
0.85 if contractors are excluded from scope

Worked example

With the default values below, Security Awareness Coverage Calculator returns Awareness Coverage Score of 59.5. Change any input above and every figure here is recalculated in your browser.

Inputs used

People in scopeaccepts 1–5,000,000 people
2,500 people
Completed the annual moduleaccepts 0–5,000,000 people
2,150 people
Contractors and third parties included
No
People in high-risk rolesaccepts 0–1,000,000 people
320 people
High-risk roles with role-specific trainingaccepts 0–1,000,000 people
180 people
Phishing simulations per yearaccepts 0–52 per year
4 per year
Click rate at programme startaccepts 0–100 %
18 %
Click rate nowaccepts 0–100 %
8 %
Report rate nowaccepts 0–100 %
20 %

Results

Awareness Coverage Score
59.5 / 100
Completion Rate
86.0%
Role-Specific Coverage
56.3%
Click Rate Reduction
55.6%
Report-to-Click Ratio
2.50 ×
Programme Rating
D — Weak
Biggest Gap
Contractors and third parties are excluded — they hold the same access and get none of the training

Step by step

  1. 1Values used
  2. 2Security Awareness Coverage
  3. 3Awareness Coverage Score= 59.5 / 100
  4. 4Completion Rate= 86.0
  5. 5Role-Specific Coverage= 56.3
  6. 6Click Rate Reduction= 55.6
  7. 7Report-to-Click Ratio= 2.50 ×
  8. 8Programme Rating= D — Weak

Assumptions and limits

  • The result is derived only from the 9 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax or fees or charges into account.
  • Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is Security Awareness Coverage calculated?

coverage = (0.28×completion + 0.22×roleSpecific + 0.30×behaviourChange + 0.20×cadence) × scopeAdjustment, where behaviourChange combines click-rate reduction and the report-to-click ratio. Completion is necessary and nearly meaningless on its own, so measured behaviour carries the largest single weight: whether clicking went down and whether reporting went up. Role-specific training is scored separately because the attacks aimed at finance, developers and executives have nothing in common with a generic module. Excluding contractors caps the score, since they typically hold equivalent access.

Why does Security Awareness Coverage matter?

A 98% completion rate with an unchanged click rate means you have documented training, not changed behaviour — and only one of those affects an incident.

What values do I need to enter?

This calculator takes 9 inputs: People in scope, Completed the annual module, Contractors and third parties included, People in high-risk roles, High-risk roles with role-specific training, Phishing simulations per year, Click rate at programme start, Click rate now, Report rate now. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Is a report-to-click ratio above 1 realistic?

Yes, and mature programmes exceed 2. It comes from making reporting a single button, acknowledging every report, and never penalising a false report — people stop reporting the moment it feels risky or tedious.

Should simulation failures have consequences?

Punitive approaches reliably reduce reporting, which is worse than the clicks. Use extra coaching for repeat clickers and reserve formal process for wilful policy breaches rather than falling for a well-crafted lure.

Related Calculators

Security Awareness Coverage Calculator | Calcrivo