Workforce Exercising Outcomes – Customer Help Center

Workforce Exercising supports two primary outcomes – Education and Assessment – and you can use either depending on where you are in your security journey.

Workforce Exercising is flexible. It can be used in different ways to achieve various outcomes, depending on your needs and what you want to accomplish.

It addresses two primary outcomes, depending on where you are within your security journey:

Education
Assessment

Outcome 1: Education

I want to go beyond just raising cyber awareness to influence a change in the security behavior of my staff.

If your goal is education, Workforce Exercising gives you two tools to work with: labs and exercises.

Labs

Labs are the primary focus for upskilling and education. They cover a range of content related to cyber security awareness, including phishing. The following collections are included: Cyber 101, Staying Safe Online, Cyber Fundamentals and AI Fundamentals. Collections within the current Management, Risk, and Compliance pathway are also included.

Exercises

Workforce Exercising also offers scenario-based exercises that engage employees through narrative-based scenarios covering various security topics, including phishing. These scenarios are fully customizable to your organization's specific needs and provide instant feedback on participant responses, enabling in-the-moment learning. After completion, takeaways and an overall score are provided to the participant for further learning and improvement.

Primary metrics

What

Why

Focus

Completion rates

(labs and exercises)

Understand access to / completion of content and identify potential issues with engagement

Compliance
Education
Individual, team, department or organization-wide

Exercise scores

Understand current areas of strength in knowledge, skills, and judgment or where upskilling is required

Education
Risk management
Individual, team, department or organization-wide

Key Takeaways

Education and awareness outcomes can be addressed by combining lab-based knowledge content with scenario-based in-the-moment learning on topics of interest.
Organizations may wish to focus on upskilling with labs before exercises, or use scenario-based exercising to identify areas for further education.

Outcome 2: Assessment

I want to understand and monitor my human cyber risk profile.

Your organisation may wish to focus on assessing your current human cyber risk. You can use the response data gathered from Workforce Exercising to identify potential risk areas – either in particular security topics or in particular staff groups. That data can then inform in-platform and off-platform interventions to mitigate those risks, and help you monitor changes in those areas over time, including measuring the impact of any interventions you make.

Security Hygiene Compass

Our Security Hygiene Compass has been developed with data in mind and focuses purely on assessment. The content has been statistically validated with an expert consensus study and user testing. It's a series of single decision parts covering all eight of our overarching security topic areas. Unlike our narrative exercises, it provides no in-the-moment response feedback or takeaways. This means that responses reflect genuine risk perceptions, without the influence of hints or immediate feedback.

Full scenario catalog

Our full scenario-based exercising catalog can also be used to collect data. Each scenario has been designed with behavioral science and data quality at its core. All of the decision points in our scenarios are linked to one of eight primary risk areas and provide data on how your workforce performed across those areas – covering actual judgments and confidence levels – with the ability to drill down to the individual and team level.

Potential metrics

What	Why	Focus
Security Hygiene Compass	Understand current areas of strength and potential risk across the organization Create a baseline level for future comparison, allowing monitoring of your human cyber risk profile over time	Risk management
Exercise Scores	Understand current areas of strength in knowledge, skills, and judgment or where upskilling is required	Education Risk management Individual, team, department or organization-wide
Change over time	Compare previous scores and completion rates with current data to monitor potential improvement and any impact of interventions	Risk management Individual, team, department or organization-wide

Key Takeaways

Data-focused outcomes can be addressed by using our Security Hygiene Compass to provide an initial understanding of your current human cyber risk profile.
Based on this, you can target interventions to address areas of concern. Using narrative-based scenario exercising as an intervention will provide further data points while educating staff in-the-moment.
We recommend running the Security Hygiene Compass every six months to measure change over time consistently. Alternatively, it can be re-run following specific interventions to assess effectiveness and impact.