Cybersecurity Awareness Month: What Boards Should Actually Be Asking

October is Cybersecurity Awareness Month. CISA’s 2026 theme is “Securing the Next 250,” tying the campaign to the country’s semiquincentennial and framing national cyber resilience as part of the broader infrastructure conversation. Most organizations will run their annual push this month: phishing simulations, an all-hands presentation, maybe a poster campaign. That’s useful, and it should happen.

But Awareness Month content is written for employees, not for boards. The governance version of this conversation is different, and it’s worth having separately, because the questions a board should be asking about organizational security posture aren’t the same questions a phishing simulation answers.

Awareness Month Measures the Wrong Thing for Governance Purposes

Most awareness campaigns are measured by completion rates and click rates on simulated phishing. Those are legitimate operational metrics. A reporting rate above 20% signals genuine behavior change, versus roughly 10% for completion-based training alone, and tracking that distinction matters for the security team running the program.

But completion percentages and simulation click rates tell a board almost nothing about the state of organizational risk. A 95% training completion rate says employees clicked through a module. It doesn’t say whether the organization’s actual human risk profile has improved, whether the training addressed the threats currently targeting the industry, or whether the same employees who completed training would recognize a sophisticated, AI-generated spear-phishing attempt targeting their specific role.

If Awareness Month reporting to your board consists of a completion percentage and a slide showing “days without incident,” that’s activity reporting, not risk reporting. It’s the same gap covered in the September 1 post on what boards get wrong about cybersecurity oversight: measuring what’s easy to measure rather than what actually informs a governance decision.

Five Questions Worth Asking Instead

1. What did this year’s phishing simulation actually test, and how did results compare to last year?

Not the click rate in isolation. The trend, and the sophistication of the lure. A simulation using a generic “password reset” email tests something fundamentally different than one using a lure crafted to mimic a specific vendor relationship or a current event relevant to your industry. If your simulations haven’t gotten more sophisticated as the actual threat has, the metric is measuring less each year even if the number looks the same.

2. Where does human risk concentrate in this organization, and is training targeted there?

Blanket, company-wide training treats every employee’s risk profile identically, which isn’t accurate. Finance and accounts payable staff face targeted business email compromise attempts that a marketing employee never sees. Executive assistants and IT administrators are frequently targeted specifically because of their access. A mature program identifies these higher-risk populations and applies targeted training and monitoring, not just the same module for everyone.

3. What’s our reporting rate, not just our completion rate?

Completion tells you people were exposed to material. Reporting tells you whether the material changed behavior. An organization with a high completion rate and a low reporting rate has spent money on training that isn’t producing the behavior change it’s meant to produce.

4. How does this connect to what we’re doing the other eleven months?

Awareness Month sticks the landing when it feeds a year-round effort. It’s a capstone to the preceding eleven months of security awareness work, not a standalone event. If October is the only month security awareness gets executive attention, that’s worth naming as a governance gap in itself.

5. What does this tell us about our broader risk posture, not just our training program?

This is the real governance question. Awareness Month is one input into a much bigger picture: technical controls, incident response readiness, third-party risk, and overall security program maturity. A board that treats the October briefing as a standalone check-in on “the human element” is missing the opportunity to connect it to everything else on the risk register.

The Governance Reframe

The useful shift for a board isn’t to abandon awareness metrics. It’s to insist those metrics come with context. Instead of “94% completion rate,” the reporting should read something closer to: “94% completion, reporting rate improved from 14% to 22% year over year, targeted training deployed to finance and IT admin populations after last year’s simulation showed elevated risk there, and this connects to a broader reduction in successful phishing-initiated incidents this year.”

That’s a governance-relevant statement. It shows trend, targeting, and connection to outcomes, not just activity.

Cybersecurity Awareness Month is a genuinely useful annual forcing function. It gets attention from parts of the organization that don’t think about security the other eleven months. The governance opportunity is making sure that attention translates into a board conversation about actual risk posture, not just a slide showing how many people clicked through a training module.

Discussion Questions

Does your board’s Cybersecurity Awareness Month reporting include trend data and targeting rationale, or just a completion percentage?
Has your organization identified its highest-risk employee populations and applied targeted training and monitoring accordingly, or does awareness training treat all employees identically?
How does your October awareness push connect to the other eleven months of your security program? Is there a documented year-round cadence, or does executive attention to human risk spike only in October?

Cybersecurity Awareness Month: What Boards Should Actually Be Asking

Awareness Month Measures the Wrong Thing for Governance Purposes

Five Questions Worth Asking Instead

The Governance Reframe

Discussion Questions

Further Reading

Leave a Reply Cancel reply