<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: measuring-training-effectiveness
description: >-
  Measure security training effectiveness using Kirkpatrick's four levels,
  behavior analytics, knowledge assessments, simulation performance correlation,
  and ROI calculations to optimize program investment.
domain: cybersecurity
subdomain: security-awareness
tags:
  - effectiveness
  - kirkpatrick
  - roi
  - assessment
  - behavior-analytics
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Measuring Training Effectiveness

## Overview

Measuring training effectiveness goes beyond completion rates. Using Kirkpatrick's
four-level model (Reaction, Learning, Behavior, Results), this skill covers assessment
design, behavior analytics, correlation analysis between training and incident metrics,
and ROI calculation to justify and optimize program investment.

## Prerequisites

| Requirement | Install |
|---|---|
| Assessment platform | Pre/post knowledge testing capability |
| Analytics | LMS + phishing platform + SIEM data correlation |
| Survey tool | Reaction and satisfaction surveys |

## Commands

| Command | Description |
|---|---|
| `node agent.js assess --level kirkpatrick-all --program annual-2026` | Run full Kirkpatrick assessment |
| `node agent.js correlate --training-data lms.csv --incident-data siem.csv` | Correlate training with incidents |
| `node agent.js roi --program-cost 150000 --incident-reduction 35` | Calculate training program ROI |
| `node agent.js benchmark --industry financial-services --year 2026` | Benchmark against industry standards |

## Workflow

### Step 1 — Assess Current State

Evaluate existing capabilities and identify gaps before implementing changes.

```bash
# Run assessment with agent tooling
node agent.js assess --level kirkpatrick-all --program annual-2026
```

### Step 2 — Plan and Design

Define objectives, scope, timeline, and success criteria.

```bash
# Plan implementation
node agent.js correlate --training-data lms.csv --incident-data siem.csv
```

### Step 3 — Execute and Deliver

Implement the planned activities and deliver outputs.

```bash
# Execute delivery
node agent.js roi --program-cost 150000 --incident-reduction 35
```

### Step 4 — Measure and Optimize

Track results against success criteria and iterate.

```bash
# Measure results
node agent.js benchmark --industry financial-services --year 2026
```

## Verification

- [ ] Prerequisites validated and tools installed
- [ ] Assessment of current state completed
- [ ] Implementation plan documented and approved
- [ ] Execution completed per plan
- [ ] Results measured against defined KPIs
- [ ] Findings documented and next steps identified
