The Wrong Dashboard

There’s a number that gets carried into boardrooms and status meetings every quarter, polished and certain, and it answers a question nobody in the room ever actually asked.

That number is completion.

94% of staff completed their security awareness training… 97% this quarter… up three points… a green arrow… a small note of congratulation in the pack. And everyone nods, because a number that goes up and to the right feels like progress, feels like control, feels like the kind of thing a board is supposed to want to see. The trouble is that the board didn’t actually gather to find out whether people clicked through a module. They gathered, whether they would put it this plainly or not, to answer one question. If something goes wrong… will our people do the right thing?!

Completion rates cannot answer that. They were never built to. A completion rate tells you that a piece of content was opened, that a human being sat in front of a screen for the mandated number of minutes and reached the end. It tells you nothing about what happens at half past four on a Thursday when a convincing email lands and the person reading it is tired and behind and about to do the thing the training was supposed to stop. The gap between knowing and doing is the entire problem… and the completion rate sits on the wrong side of it.

So boards are handed certainty about the thing that does not matter, in place of insight about the thing that does.

And it is not that the data they actually need does not exist. It does. It just looks different. It looks like how people behave when they are put under pressure in a setting designed to reveal it. Who hesitates before clicking. Who escalates and who stays silent. Who raises the alarm without being told to, and how quickly. Who freezes, who leads, who reaches for the right action before conscious thought has caught up. These are observable. They can be measured. They are the actual texture of security culture… and they are precisely what an immersive experience surfaces and a module never will.

When we put a team through an experience, what comes out the other side is not a completion rate. It is a picture of behaviour. The patterns of a real group of people responding to a real moment of pressure, which is the closest thing you can get to the situation the board is actually worried about without waiting for a genuine incident to teach you the answer the expensive way. That is a dashboard worth taking upstairs. Not a record of who sat through what. A read on who will do what when it counts.

The shift that needs to happen is not technical. It is about deciding what counts as evidence. For two decades the industry has reported on activity because activity is easy to count, and it has called that activity proof. It is not proof. The global average cost of a breach reached 4.44 million dollars in 2025, and not one pound of that was prevented by a completion certificate. Boards are starting to sense the mismatch. They are starting to ask harder questions about what all this assurance actually assures.

Give them the right answer. Not the comfortable number that goes up every quarter and changes nothing… but the harder, truer picture of how your people behave when the pressure is real. That is the only dashboard that has ever been worth looking at.