Workforce Exercising Outcomes

A key benefit of Workforce Exercising is its versatility. It can be used in different ways to achieve various outcomes, depending on your needs and what you want to achieve.

It can address two primary outcomes, depending on where you are within your security journey:

1. Education
2. Assessment

Outcome 1: Education 

I want to go beyond just raising cyber awareness to influence a change in the security behavior of my staff (workforce)

Educate with:

• Labs

Workforce Exercising includes labs, the primary element focused on upskilling and education. 

Labs include a range of content related to cyber security awareness and include labs on phishing. The following collections are included: Cyber 101, Staying safe online, and Cyber fundamentals. Collections within the current Management, Risk, and Compliance pathway are also included.

• Exercises

Workforce Exercising also offers scenario-based exercises designed to engage employees through narrative-based scenarios covering various security topics, including phishing. These scenarios are fully customizable to fit an organization's specific needs and provide instant feedback on participant responses, allowing for in-the-moment learning. After completion, key takeaways and an overall score are provided to the participant for further learning and improvement.

Primary metrics

What	Why	Focus
Completion rates (labs and exercises)	Understand access to / completion of content and identify potential issues with engagement	Compliance Education Individual, team, department or organization-wide
Exercise scores	Understand current areas of strength in knowledge, skills, and judgment or where upskilling is required	Education Risk management Individual, team, department or organization-wide

Key Takeaways Education/awareness focused outcomes can be addressed by combining lab-based knowledge content with scenario-based in-the-moment learning on topics of interest. Organizations may wish to focus on upskilling with labs before exercises or use scenario-based exercising to identify areas for further education.

Outcome 2: Assessment 

I want to understand and monitor my human cyber risk profile

Your organization may wish to focus on assessing your current human cyber risk, using the response data that is gathered from Workforce Exercising to identify potential risk areas (either in particular security topics or in particular staff groups). You can use this data in in-platform, and off-platform interventions to mitigate those risks and monitor change in these risk areas over time, including measuring the impact of any interventions they make.

Our Security Hygiene Compass has been developed with data in mind and focuses purely on this aspect. The content has been statistically validated with an expert consensus study and user testing. It is a series of single decision parts covering all eight of our overarching security topic areas. Unlike our narrative exercises, it provides no in-the-moment response feedback or key takeaways. 

Our full scenario-based exercising catalog can also be used to collect data, and each scenario has been designed with behavioral science and data quality at its core. All of the decision points in our scenarios are linked to one of eight primary risk areas and provide data on how your workforce as a whole performed across these different areas, both in terms of their actual judgments and how confident they were in these judgments, as well as a drill down to the individual and team level. 

Potential metrics

What	Why	Focus
Security Hygiene Compass	Understand current areas of strength and potential risk across the organization  Create a baseline level for future comparison, allowing monitoring of your human cyber risk profile over time	Risk management
Exercise Scores	Understand current areas of strength in knowledge, skills, and judgment or where upskilling is required	Education Risk management Individual, team, department or organization-wide
Change over time	Compare previous scores and completion rates with current data to monitor potential improvement and any impact of interventions	Risk management Individual, team, department or organization-wide

 

Key Takeaways Data-focused outcomes can be addressed by using our Security Hygiene Compass to provide an initial understanding of your current human cyber risk profile. Based on this, you can target interventions to address areas of concern. Using narrative-based scenario exercising as an intervention will provide further data points while educating staff in-the-moment. We recommend running the Security Hygiene Compass every six months to measure change over time consistently. Alternatively, it can be re-run following specific interventions to assess effectiveness and impact.