What security awareness metrics should MSPs show clients in QBRs?

Pick metrics the owner can understand in a few seconds and that tie to a decision. Five is usually enough.

A single click rate tells the owner very little. A rate that falls over three quarters tells a clear story: training is working and the money is well spent.

Show at least the last four quarters where you have them. If a quarter used much harder simulations, note it, because a harder lure can push the click rate up without anyone getting worse.

Microsoft makes a similar point in its own tooling, which estimates a predicted compromise rate per payload so actual results can be compared with how difficult the email was.

Both matter, but report rate is often the better sign of a healthy culture. A low click rate can mean people ignore email; a rising report rate means they notice threats and tell someone.

Track how quickly reports arrive as well as how many. A report within minutes of the email landing is far more useful than one the next day.

Reporting also has a direct security benefit. When one person reports a real phishing email quickly, the MSP can remove it from other mailboxes before anyone else clicks.

Bad data ruins a QBR faster than bad results. Two problems cause most of it.

Keep it to one slide or one page. For each metric give the current figure, the trend, a sentence on what it means and one action.

For example: "Click rate fell from last quarter. Three people clicked twice; we will give them a short follow up lesson this month."

Avoid naming and shaming individuals in a group meeting. Share names privately with the owner or manager if follow up is needed.

End with the plan for next quarter: what simulations are coming, who needs follow up training and any staff changes to sync. That turns the metrics into a reason for the client to keep the service running.

The same numbers often answer questions on cyber insurance applications. Some forms ask whether training is at least annual, whether it includes phishing simulations, and whether people who fail get more training. AIG's CyberEdge ransomware supplemental, for example, asks whether fewer than 15% of employees were successfully phished on the last test.

NIST's guidance on building a learning program (SP 800-50 Rev. 1) also recommends using metrics and evaluation to improve training over time, which gives owners a recognised reference for why you track these figures.

Hand the client a dated report for the period so they can attach it to an application or keep it on file. NetMinder generates a branded cyber insurance report PDF for any date range with who was trained, simulations sent, click and report rates, and completion, which MSPs can reuse in QBRs.