Practice 04 of 6Scored 1 to 53 questions in the assessment
Prove
Can you show, with your own numbers, that risk went down?
Prove is the practice of measuring the program’s effect: from completion and click rates, through behavior trends and cohort sizes, to incident lift, avoided loss and board key risk indicators inside a stated risk appetite.
Why it matters
Prove, in practice.
A program that cannot show its effect competes for budget on belief. Numbers that leadership can check, with a method finance and audit accept, turn the program from a cost into a risk control, and they tell the program itself which actions worked.
The five levels
The five levels of Prove.
Each level with its criteria, the evidence to ask for and what moves the practice to the next one.
-
Level 1
Comply
Completion percentage for auditors.
- The program reports training completion and simulation click rate.
- The audience is the auditor or the compliance owner.
- No reported number connects program activity to incidents.
- Reports are produced once a year or on request.
Evidence to ask for
The last report sent outside the team
What moves you to level 2
- Report the report rate next to the click rate, and the ratio between them.
- Report trends quarter over quarter per team.
- Send a one-page report to the CISO each quarter.
-
Level 2
Observe
Behavior trends quarter over quarter to the CISO.
- Behavior trends are reported quarter over quarter per team.
- Report rate is reported next to click rate.
- The CISO receives the report on a fixed cadence.
- Program reach (people, content, nudges) is reported.
Evidence to ask for
The last two quarterly reports · The distribution list
What moves you to level 3
- Report stage 3+ people per priority breach scenario with a trend.
- Report cohort sizes against targets the CISO set.
- Map the program’s metrics to the control framework the organization follows.
-
Level 3
Prioritize
Stage 3+ per breach scenario and cohort sizes against targets, mapped to the control framework.
- Stage 3+ people per priority breach scenario are reported with a trend.
- Cohort sizes are reported against targets the CISO set.
- Time from signal to action is reported per playbook.
- Program metrics are mapped to NIST CSF 2.0 outcomes or to another framework the organization follows.
Evidence to ask for
The quarterly report with stage and cohort pages · The crosswalk from metrics to framework outcomes
What moves you to level 4
- Measure incident lift and count avoided incidents.
- Compute training hours saved by targeting.
- Add security NPS and perceived friction to the report.
- Build a one-page executive summary.
-
Level 4
Orchestrate
Incident lift, avoided loss and training hours saved each quarter.
- Incident lift of the top patterns is reported each quarter.
- Avoided loss is estimated with a method finance agreed to, and the method is published with the number.
- Training hours saved by targeting are reported.
- Security NPS and perceived friction rate are reported against targets.
Evidence to ask for
The quarterly executive report · The avoided-loss method sign-off from finance · The lift table
What moves you to level 5
- Define board key risk indicators with a threshold tied to risk appetite.
- Report human risk reduction over 6, 12 and 24 months.
- Have internal audit review the measurement method.
-
Level 5
Preempt
Board KRIs inside risk appetite; reduction over 6, 12 and 24 months; method audited.
- Board key risk indicators for human risk have thresholds tied to a stated risk appetite and are reviewed each quarter.
- Human risk reduction is reported over 6, 12 and 24 months with the model version and method.
- People and AI agents are reported on one index.
- Internal audit or a third party has reviewed the measurement method and data lineage.
Evidence to ask for
The board pack with KRIs and thresholds · The audit report on the method · The 24-month trend
How to hold level 5
- Re-baseline KRIs when the model version changes and show both series for two quarters.
- Repeat the independent review of the method every two years.
Playbooks
Playbooks for Prove (11).
The assessment picks from these for your 90-day roadmap, by your current level. Each playbook is Easy, Medium or Hard; a quick win is an Easy playbook.
Scroll sideways to see every column.
| From level | Playbook | Owner | Weeks | Difficulty | Measure |
|---|---|---|---|---|---|
| 1 | Publish the report-to-click ratio Report reports divided by clicks per simulation, next to completion. The ratio is the first number that shows vigilance. | Security awareness lead | 1–2 | Easy | Report-to-click ratio |
| 1 | Send a one-page quarterly report to the CISO Put four numbers, one trend and one decision needed on a page each quarter. The reporting habit creates the demand for better numbers. | Security awareness lead | 5–8 | Medium | Quarterly reports delivered on time |
| 2 | Set a target for each cohort and report against it Agree with the CISO a target size for repeat clickers and weak-MFA privileged users and show progress each quarter. A number with no target is trivia. | CISO | 1–4 | Easy | Cohorts reported against a target |
| 2 | Report stage 3+ people per priority breach scenario Add the count and trend of people at stage 3 or above for each priority breach scenario. The count links the program to breach scenarios. | Security awareness lead | 5–9 | Medium | Stage 3+ count per breach scenario with trend |
| 2 | Map program metrics to the control framework Tie each reported metric to a NIST CSF 2.0 outcome or to the framework the organization follows. The map lets GRC and audit reuse the program’s numbers. | GRC lead | 6–10 | Medium | Metrics mapped to framework outcomes |
| 3 | Compute training hours saved by targeting Compare hours delivered under the targeted schedule with the old whole-workforce schedule. Saved hours is a number the CFO reads. | Security awareness lead | 1–3 | Easy | Training hours saved per quarter |
| 3 | Report incident lift and avoided incidents Publish lift per pattern and the incidents avoided where sequences were interrupted. Avoided incidents is the proof of risk reduction. | SOC | 5–13 | Hard | Avoided incidents per quarter |
| 4 | Draft five board KRIs with thresholds Pick five numbers (stage 3+ share, time to action, report rate, phishing-resistant MFA, agents with owners) and propose a threshold for each. The draft starts the risk appetite conversation. | CISO | 2–4 | Easy | KRIs with approved thresholds |
| 4 | Estimate avoided loss with a method finance agreed Multiply avoided incidents by the loss range per breach scenario and publish the method with the number. An agreed method beats a big number. | CISO | 5–10 | Medium | Avoided loss per quarter with the method published |
| 5 | Have internal audit review the measurement method Hand the method, data lineage and model change log to internal audit. Independent review keeps the board’s trust in the numbers. | GRC lead | 1–4 | Easy | Open audit findings on the method |
| 5 | Report human risk reduction over 6, 12 and 24 months Publish the index change over three horizons with the model version used. Long horizons show whether gains hold. | CISO | 5–9 | Medium | Risk reduction at 6, 12 and 24 months |
"Prove: the practice", Human Risk Management Framework v2.0.0, Living Security, CC BY 4.0. https://www.humanriskmanagement.com/maturity-model/prove
HRM Maturity Assessment
Where does your program stand?
An initial assessment: 18 questions, about 4 minutes. Your level, six practice scores and a 90-day roadmap, shown immediately.
- Questions
- 18
- Minutes, about
- 4