Start with a decision, not a label
“People are the weakest link” is a poor operating model. It says nothing about the situation, the control environment or what a person needs to do differently. A more useful question is specific: will someone verify a supplier’s bank-detail change through a known channel? That question leads to a testable objective.
The objective should describe a safe behavior, the context in which it matters and the evidence that could show improvement. It should also acknowledge that secure behavior depends on workable processes, not only awareness.
Connect the activities you already run
Simulations reveal responses under controlled conditions. Employee reports show what people notice in daily work. Analysis adds context to those reports. Learning provides a chance to practice a safer response. Each activity produces a different kind of evidence.
A connected program lets one activity inform the next. A repeated payment-redirection concern can shape a finance scenario. That scenario can identify a learning need. A later test can revisit the decision without repeating the original message.
Interpret behavior in context
A department’s results cannot be understood without knowing its exposure, scenario mix and coverage. More reports can reflect more threats, more awareness or both. Lower interaction can reflect a less convincing test. Keep those explanations available before assigning meaning to a trend.
Use aggregate evidence to prioritize support. Employee-level information requires a clear purpose, appropriate access and a fair interpretation. A risk label should never substitute for understanding an event.
Build a review cycle
For each learning objective, record the baseline, planned intervention and reassessment conditions. Decide how you will interpret missing data. Discuss results with the people responsible for the workflow, then adjust the next cycle.
The output is not simply a score. It is a defensible decision about what to improve, what to investigate and what you still do not know.