<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: building-security-culture-metrics
description: >-
  Build and track security culture metrics including phishing resilience scores,
  reporting rates, training engagement, security survey indices, and behavior
  change indicators to demonstrate program ROI to leadership.
domain: cybersecurity
subdomain: security-awareness
tags:
  - metrics
  - culture
  - kpi
  - reporting
  - behavior-change
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Building Security Culture Metrics

## Overview

Security culture metrics quantify an organization's human security posture beyond
compliance checkboxes. This skill covers designing metric frameworks, collecting data
from multiple sources (LMS, phishing platform, ticketing, surveys), building dashboards,
and producing executive reports that demonstrate program ROI and behavior change.

## Prerequisites

| Requirement | Install |
|---|---|
| Data sources | LMS, phishing platform, ITSM, survey tool |
| Visualization | Grafana, Power BI, or Python matplotlib |
| Survey platform | Culture survey tooling |

## Commands

| Command | Description |
|---|---|
| `node agent.js dashboard --sources lms,gophish,surveys` | Build security culture dashboard |
| `node agent.js trend --metric click-rate --period 12m` | Analyze metric trends over time |
| `node agent.js survey --template culture-assessment` | Generate security culture survey |
| `node agent.js report --format executive --quarter Q1-2026` | Generate executive metrics report |

## Workflow

### Step 1 — Assess Current State

Evaluate existing capabilities and identify gaps before implementing changes.

```bash
# Run assessment with agent tooling
node agent.js dashboard --sources lms,gophish,surveys
```

### Step 2 — Plan and Design

Define objectives, scope, timeline, and success criteria.

```bash
# Plan implementation
node agent.js trend --metric click-rate --period 12m
```

### Step 3 — Execute and Deliver

Implement the planned activities and deliver outputs.

```bash
# Execute delivery
node agent.js survey --template culture-assessment
```

### Step 4 — Measure and Optimize

Track results against success criteria and iterate.

```bash
# Measure results
node agent.js report --format executive --quarter Q1-2026
```

## Verification

- [ ] Prerequisites validated and tools installed
- [ ] Assessment of current state completed
- [ ] Implementation plan documented and approved
- [ ] Execution completed per plan
- [ ] Results measured against defined KPIs
- [ ] Findings documented and next steps identified
