Cut Human-Driven Incidents: A CISO Playbook for Measurable Behaviour Change
Get a board-ready way to report behaviour change instead of training completion.
Why this playbook exists
- 76%of large UK firms provide security awareness training, according to the UK NCSC.See page 1
- 60%of data breaches still involve human factors, according to Verizon's 2025 DBIR.See page 1
What you take away
- Report behaviour change to the board, not training completion.
- Plan training per employee from role, language, simulation history and behaviour.
- Trigger short nudges on behavioural signals, such as straight after a click.
- Set a 90-day path: one day to connect, a 30-day pilot, then ongoing optimisation.
Start reading
- 1 / 8
- 2 / 8
- 3 / 8
Read the other 5 pages
They open right here. You can also download the PDF.
Tap a page to read it full size.
What the whitepaper covers
- Executive summary: impact and economics
- The problem: the compliance trap
- The solution: behavioural microlearning powered by Agentic AI
- Scaling change: leadership and infrastructure
- Economics and outcomes: results CISOs can take to the board
- Implementation and next steps
- The bottom line
Who it is for
CISOs and CIOs who must show the board that awareness spend changes employee behaviour, not only completion rates.
How the data was collected
- Sample
- Not stated
- Period
- 2025
- Source
- Aggregated Keepnet customer success data; third-party figures from UK NCSC and Verizon 2025
- Note
- The PDF states results may vary by deployment scope, maturity and engagement. No customer count, sample size or calculation is given.
Cite this whitepaper
Keepnet (2026). Cut Human-Driven Incidents: A CISO Playbook for Measurable Behaviour Change. https://keepnetlabs.com/whitepapers/cut-human-driven-incidents
Figures on this page may be quoted with this citation.
Security Awareness Training
Send training matched to role, risk and behaviour, and see behaviour change before and after.
About this whitepaper
The whitepaper argues that completion shows effort, not impact. High completion can sit alongside rising incidents.
The whitepaper puts it at an average of $7,000 and 4 weeks per module, built by a team of 5 to 7. It does not cite a source for these figures.
It runs five steps: plan, create, deliver, measure and improve. Training is planned from department, title, language and simulation history, and nudges trigger on behavioural signals.
The whitepaper sets out a 90-day path. Setup takes one day to connect Microsoft 365, the LMS and security tools, followed by a 30-day pilot and ongoing optimisation.
Keep reading
2025 New Hires Phishing Susceptibility Report
44%more susceptible to phishing: new hires in their first 90 days compared with tenured employeesRead the key findings
The Mobile Phishing Visibility Gap
~40%higher click rate on phone-based simulations than on email (Verizon DBIR 2026).Read the key findings
2024 Voice Phishing (Vishing) Response Report
6.5%of 3,279 employees called shared sensitive information during simulated vishing calls.Read the key findings
The State of the Smish Report 2023
74%of organisations experienced a smishing attack in 2021, according to Safety Detectives.Read the key findings
2021 Email Security Vulnerability Report
90.56%of checked malicious test emails reached the target inbox past the security tools in place.Read the key findings
MSSP Business Model
$1.3 millionis the payroll an in-house team can reach once it staffs its own 24x7 SOC, according to Cipher.Read the key findings
2020 Phishing Trends Report
50.42%of simulated phishing emails were opened by the target in 2019.Read the key findings
Threat Sharing
206 dayswas the average time to detect a breach, according to IBM's 2019 Cost of a Data Breach Report.Read the key findings
See how Keepnet would act on these findings for you
- Run multi-channel simulationsFrom email through to deepfake.
- See reporting outcomes and the behaviour scoreReporting, repeat behaviour and remediation, in one board report.
- Explore AI agents and automationSee how simulations, training and follow-up can run with less manual work.
Book a 30-minute demo
Thirty minutes, no cost and no obligation.
Thank you, your request is in
A confirmation is on its way to your inbox.
Thirty minutes with the Keepnet team, on Microsoft Teams. Your details are already filled in.
Prefer to pick a time later? The team will follow up within one working day.
Your demo is booked
A calendar invite is on its way to your inbox, with a Microsoft Teams link.
The booking calendar will not open in this page.
Open the calendar in a new tab