Measuring Human Risk: What CISOs Should Report to the Board
There is a moment in many board meetings that quietly reveals how an organization thinks about cyber risk. The Chief Information Security Officer presents, and somewhere in the deck appears a slide about security training, almost always showing a completion percentage. Ninety-four percent of employees finished their training, the slide announces, and heads nod approvingly. The board moves on, reassured.
It should not be reassured, because that number answers a question the board never actually needed to ask. Directors do not care, and should not care, how many people clicked through a module. They care about risk, whether it is rising or falling, where it concentrates, and what is being done about it. The gap between what CISOs often report and what boards actually need is one of the most important conversations in security today, and closing it starts with measuring human risk properly.
The Problem With Reporting Activity Instead of Risk
Completion rates are what is known as an activity metric. They measure effort expended, not outcomes achieved. They are seductive because they are easy to gather and comfortable to present, the number is almost always high and almost always rising. But they tell the board nothing about the organization’s actual exposure.
This matters more now that the limitations of training-as-activity are documented. Verizon’s 2025 Data Breach Investigations Report found that click and failure rates were largely unaffected by traditional one-off training. So a slide showing 94% completion may sit directly alongside a workforce that is no more resistant to attack than it was a year ago. The metric implies progress that the underlying reality does not support. Reporting it to the board is not just unhelpful; it is quietly misleading.
Boards are increasingly sophisticated about this. They are accustomed to risk-based reporting from finance, operations, and legal, expressed in terms of exposure, trend, and mitigation. Security should speak the same language. The CISO’s job is not to prove the team has been busy. It is to give directors an honest, decision-useful picture of one of the organization’s largest risk categories, given that roughly 60% of breaches involve a human element (Verizon 2025 DBIR).
Measuring Human Risk in Terms a Board Understands
So what should be measured instead? The shift is from “what did we do” to “how exposed are we, and is that changing.” A mature human risk program produces metrics that map directly to risk, and they can be communicated without a word of technical jargon.
The most useful measures tend to include:
1. A human risk score, an aggregate measure of how susceptible the workforce is to attack, trended over time so the board can see direction, not just a snapshot.
2. Phishing susceptibility, how often people actually fall for realistic simulated attacks, broken down so that concentrations of risk become visible.
3. Reporting behavior, how quickly and how often employees report suspicious activity, which is a powerful leading indicator of a healthy security culture.
4. Risk concentration by role and department, showing where the organization’s exposure is highest, the finance team that approves payments, the executives who are prime targets for impersonation.
The unifying principle is trend and concentration. A single number in isolation means little. A risk score that has fallen 30% over two quarters, or a finance department whose susceptibility is markedly higher than the rest of the business, tells a story the board can act on. That is the difference between data and intelligence.
The Executive Dashboard the Board Actually Wants
Imagine replacing the completion-rate slide with a single, clear dashboard. At the top sits the overall human risk score and its trend line. Below it, a simple view of where risk concentrates by function. Alongside, the reporting rate, climbing steadily, evidence that the culture is becoming more vigilant. And a short narrative connecting these numbers to the threats the organization actually faces and the actions being taken in response.
This dashboard does several things the old slide could not. It lets the board see risk moving over time, which is the only way to judge whether investment is working. It highlights where to focus attention and resources. And it frames human risk as a managed, measurable discipline rather than a vague hope. When a director asks “are we getting safer?” the CISO can answer with a line on a chart rather than a shrug dressed up as a completion percentage.
It also lets the CISO connect internal posture to the external threat landscape in a way boards find compelling. The dashboard becomes the place to explain that AI-generated phishing became the top enterprise email threat by late 2025, that deepfake-enabled scams are surging, with one firm, Arup, losing $25 million to a deepfake video call impersonating its CFO in 2024, and that the organization’s measured susceptibility to exactly these tactics is being tracked and reduced. That is a far more powerful narrative than any activity metric.
Tying Human Risk to the Numbers Boards Care About
Boards think in terms of financial exposure and regulatory consequence, and human risk metrics should be translated into both. The financial framing is straightforward: with the global average cost of a data breach at $4.44 million and the US average reaching $10.22 million in IBM’s 2025 report, and with business email compromise alone causing $3.046 billion in losses according to the FBI’s IC3 2025 report, reducing human susceptibility is a direct reduction in expected loss. A falling risk score is not an abstraction; it represents real money not lost.
The regulatory framing is equally board-relevant, particularly in India. The DPDP Act, with rules finalized in November 2025 and full compliance expected by around mid-2027, carries penalties of up to ₹250 crore for failing to maintain reasonable security safeguards. A board has a governance duty to ensure those safeguards exist and are working. A credible human risk dashboard is precisely the kind of evidence that demonstrates the board took its oversight responsibility seriously, which matters enormously if the organization’s diligence is ever questioned.
When human risk is reported this way, the conversation in the boardroom changes. It stops being a compliance update the directors politely endure and becomes a genuine risk discussion they can engage with, challenge, and resource appropriately.
From Reassurance to Real Oversight
The role of board-level security reporting is not to reassure directors that everything is fine. It is to give them an honest enough picture that they can govern effectively, ask sharp questions, and direct resources where they matter most. Completion rates offer reassurance. Human risk metrics offer oversight. The mature organization knows which one it actually needs.
For CISOs, making this shift is also a way to elevate the function. Reporting risk in the board’s language, trended, concentrated, tied to money and regulation, positions security as a strategic discipline rather than an IT cost center. It earns the credibility and the budget that come from speaking plainly about real exposure.
Conclusion
The completion-rate slide answers a question boards never needed to ask, while leaving the one they care about, whether human risk is rising or falling, unanswered. Directors are fluent in risk-based reporting from finance and operations, and security should speak the same language: human risk scores, phishing susceptibility, reporting behavior, and risk concentration by role, all trended over time. Translated into financial exposure and regulatory consequence, these metrics turn a polite compliance update into a genuine governance discussion. Real oversight comes not from reassurance but from an honest enough picture that the board can challenge, resource, and direct.
How Shieldbyte Infosec Can Help
Shieldbyte Infosec’s ShieldPhish platform is designed to give security leaders exactly the view their boards need. Continuous phishing simulations generate real behavioral data rather than completion checkboxes, feeding a human risk score that trends over time and reveals where exposure concentrates by role and department. Adaptive training then drives those scores down where susceptibility is highest, so the chart the CISO presents reflects genuine improvement. Executive dashboards translate this into the language of trend, concentration, financial exposure, and regulatory diligence that directors can act on. The result is reporting that demonstrates oversight rather than mere activity. If your next board update could be more honest about human risk than the last, we would be glad to help you build the view your directors deserve.