Security Awareness Program Design and Metrics

This unit guides learners through designing, delivering, measuring, and iterating security awareness programs for business settings. Students will learn to create quarterly delivery plans, apply gamification and engagement techniques, decide on and run phishing simulations, and produce meaningful metrics and ROI-focused reports to drive program improvement.

Learning Objectives

• Analyze behavioral and program data by selecting appropriate metrics, creating meaningful reports, and interpreting results to identify at least three targeted opportunities for improvement in awareness behaviors
• Apply instructional design and engagement strategies—including gamification elements, topic selection, and promotional tactics—to develop a quarterly delivery strategy and promotional plan with measurable goals and defined audience segments
• Demonstrate the ability to plan, configure, and execute a basic phishing simulation (or justify the decision not to include one) by selecting tools, preparing templates, conducting the simulation, and documenting click/report rates and follow-up training actions
• Evaluate program effectiveness and ROI by assessing tangible and intangible benefits, addressing mental models and group-psychology factors, and producing a written program reevaluation and redesign recommendation that prioritizes risk reduction and achievable behavior change