Most awareness programs quietly become exams. A module ends, a quiz appears, a completion rate is logged, and everyone moves on. The number looks reassuring. It rarely predicts whether anyone will behave differently the next time a convincing message lands in their inbox.
The problem is not testing itself. It is what a test rewards. An exam rewards recall under calm conditions. Real risk arrives under the opposite conditions: distraction, time pressure, and a message engineered to feel routine. People who score perfectly on a multiple-choice quiz can still click, because clicking is not a knowledge failure. It is a judgment made in three seconds while doing something else.
Measure the behavior you actually want
If the goal is fewer harmful actions and faster reporting, those are the things worth measuring. Reporting rates, time-to-report, and the proportion of staff who pause on an unusual request tell you more than any completion percentage. They describe what people do, not what they can repeat back.
A behavioral metric also changes the tone of the program. Reporting a suspicious message becomes a contribution, not an admission of weakness. When the metric rewards raising a hand, more hands go up — and the security team gets earlier, better signal.
Design for the moment of decision
Knowledge that cannot be recalled at the moment of decision is decoration. The useful question is not “did they learn it” but “will it surface when it matters.” That favors short, frequent, role-relevant prompts over long annual courses, and plain language over jargon.
None of this means abandoning measurement. It means measuring the habit, not the recital. An exam tells you who studied. Behavior tells you whether the program worked.