Security Governance · Topic 3 of 3
Security Awareness and Measuring Effectiveness
Security culture, social engineering, phishing and password protection, AI-era awareness, and measuring security with metrics, KRIs, dashboards and scorecards.
- 3 min
- Leadership sets the security culture.
- Know phishing, spear phishing, vishing, smishing, tailgating and pretexting.
- Verify unusual requests through a separate trusted channel.
What it is
People are both a target and a defense. Security awareness builds a culture in which staff recognize threats and act safely. Measuring effectiveness shows leadership whether security, including awareness, is actually working.
How it works
Organizational culture
A strong security culture starts with leadership: when managers follow the rules and talk about security, staff take it seriously. People should feel safe reporting mistakes and suspicious activity quickly.
Awareness topics
| Topic | Key points |
|---|---|
| Social engineering | Manipulating people into giving access or information: pretexting, baiting, tailgating, impersonation |
| Phishing | Fraudulent messages that try to steal credentials or install malware; spear phishing targets specific people; vishing uses voice; smishing uses text messages |
| Password protection | Long passphrases, no reuse, password managers, MFA, never share passwords |
| Reporting | How and where to report suspicious messages or incidents |
Awareness in the AI era
| Risk | What staff should do |
|---|---|
| AI-written phishing | Poor spelling is no longer a reliable clue; judge the request itself: urgency, unusual payment, mismatched sender |
| Deepfake voice or video | Verify unusual requests through a separate, known channel, such as calling back on a directory number |
| Data pasted into public AI tools | Never enter confidential or personal data into unapproved AI services |
| AI hallucinations | Check AI answers and sources before relying on them |
To verify an urgent request that sounds like a senior manager, contact the person through a channel you already trust, never through details supplied in the request.
Measuring effectiveness
| Measure | What it is | Example |
|---|---|---|
| Key metric (KPI) | How well a process performs | Percentage of critical patches applied within 14 days |
| Key risk indicator (KRI) | Early warning that risk is rising | Number of AI tools in use without approval (shadow AI) |
| Dashboard | Visual, near real-time view of key measures | Security operations dashboard |
| Scorecard | Results against targets, often color coded | Quarterly security scorecard for executives |
| Report | Written summary with context and recommendations | Annual risk report to the board |
Good measures track outcomes, not just activity. Phishing report rates show behaviour better than training completion counts. A coverage figure such as "99 percent of servers scanned" is only meaningful if the asset inventory behind it is complete.
AI risk indicators
Examples: rising use of unapproved AI services, sensitive data appearing in AI prompts, the share of AI systems with a completed risk review, and how often analysts override an AI tool's decisions.
How the exam asks about this
- "Which phishing clue is less reliable now that attackers use generative AI?" Poor spelling and grammar.
- "Which measure warns that risk is increasing?" A key risk indicator.
- "99 percent of servers are scanned, yet an unscanned server was breached." The inventory was incomplete.
What to remember for the exam
- Leadership sets the security culture.
- Know phishing, spear phishing, vishing, smishing, tailgating and pretexting.
- Verify unusual requests through a separate trusted channel.
- KPIs measure performance; KRIs warn of rising risk.
- Measure behaviour and outcomes, not just training completions.
Awareness training alone cannot stop every attack. Combine it with technical controls such as email filtering and MFA.
Common mistakes
Relying on spelling errors to spot phishing.
Measuring training attendance instead of behaviour.
Confusing KPIs with KRIs.
Check yourself
What is vishing?
Phishing carried out by voice, such as phone calls.
What is a key risk indicator?
A measure that gives early warning that a risk is increasing.
How should staff verify an urgent payment request in a manager's voice?
Call the manager back on a known, trusted number.
Topic 3 of 3 in Security Governance
Test yourself on Security Governance
The full ISC2 CC question bank has 671 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.