European Cyber Security Month: How to Measure the Success of Your Security Awareness Campaigns
European Cyber Security Month - Measuring Success @channel It’s my final instalment of things to consider ahead of Security Awareness Month, so let’s tackle something meaningful - metrics. This month gives us some rare things: budget, attention, and a captive audience for four weeks, and the hard part isn't producing the content (we've done that for you here - sosafe-awareness.com/ecsm-2026) - it's proving it worked. Many of us finish the month with ticked communication objectives and an ‘engagement’ figure, but still can't answer the key question: did behaviour change 🤷? The challenges
💬 Engagement is not action. Page views, stand visits, and quiz completions tell you people were exposed to content, not that they did anything differently afterwards.
⌛ The measurement window is short. A month of content won't produce a month of measurable behaviour change - culture shifts show up over a longer horizon, well after the campaign team has moved on.
🤔 Self-reported confidence is unreliable. It’s helpful to have a post-campaign survey asking “do you feel more confident reporting a security concern?”, but it’s measuring sentiment, not action.
👉 Attribution is challenging. If reporting rates rise in October, was it the campaign, a recent ‘near miss’, or a manager reminding their team?
Solutions worth trying
💥 Pick the key behaviours before the month starts. As mentioned in my first ECSM post, run a cultural maturity assessment to decide which behaviours need to change and which teams need most attention. Then select some associated metrics - for a ‘Safe Data Handling’ theme, that might be DLP blocks and overrides, or the percentage of documents classified on creation.
📈 Baseline first. Pull three months of the metric before the campaign launches, so later numbers have something real to sit against.
⏰ Extend measurement past the month itself. Behaviour changes that fade within two weeks aren't culture change - they're a reaction resetting to baseline. Re-check the same metric at 30 and 90 days.
👀 Widen your view. In the Communications Plan, we had a column just for measurement - review those ideas, e.g. how many reminder (‘trigger’) stickers are still on phones after 90 days.
📶 Trend analysis. As part of the feedback loops we discussed last week, record every comment, complaint and question from staff to follow up and build trust. Analysis can reveal the problem areas needing attention, and an appetite to revisit issues you though were done.
💬 Engagement still matters. Exposure doesn't strongly correlate with behaviour change, but tracking interactions can indicate which channels are most successful.
🔄 Follow up. Pair behavioural metrics with something qualitative - speak to line managers or run a short survey in later months to confirm that message landed, and stuck. If behaviours changed, ask why.
None of this needs to be complicated. It needs to be decided before the campaign launches, tied to a few specific behaviours, and checked again after the noise has died down. Focus on creating metrics that tell leadership something important about how the organisation actually behaves and where the risks still lie. That’s all on ECSM for now, but we are planning something for November – hopefully where we can all review what happened, what worked and we’ll avoid next time. Best of luck everyone 🫡!