Measuring security awareness in a Swiss SME

Measuring security awareness

Measuring security awareness in a Swiss SME works when you track whether people report suspicious mail, whether training repeats on a sensible rhythm, and whether payment rules are used in real supplier changes. It fails when you publish phishing click league tables or invent industry benchmarks. Numbers should improve decisions and evidence for insurers or customer audits, not shame individuals.

This checklist is for owners and HR in firms with about 20 to 250 staff who already ran or plan training. We do not cite invented click rates. Format choice sits in e-learning vs live security awareness.

Metrics that help in practice

Internal report volume and response time. Count how many suspicious messages reach your security or IT address each quarter. Note the median time from report to an acknowledgement (even a short “received, thank you”). A rise in volume often means trust, not more attacks. Ask reception and finance whether reports go to the official address or to a favourite colleague; drift shows your metric lies.

Coverage of repeat training. List live session dates, e-learning completion exports, and onboarding slots for new hires in the last twelve months. Divide trained headcount by current staff (round sensibly for part-timers). Auditors want continuity, not one heroic afternoon three years ago. Keep topic titles, not full slide decks, in the folder.

Payment control use. Finance logs whether IBAN changes triggered a callback to a known number, not only whether payment went out. Count verification steps used per quarter without naming staff. BACS business email compromise guidance stresses awareness in the finance department; your log shows you acted on it.

Near-miss follow-through. After a close call (almost paid a wrong IBAN, almost shared credentials), record what changed: rule text, tool setting, training date, or mailbox alias. Without follow-through, measurement becomes theatre.

Optional pulse, not a hidden exam. Two months after training, five oral questions in a team meeting beat a surprise test: whom to call, where to report mail, what to do before paying a new IBAN. Rotate teams if you have several sites. Write themes in notes, not grades per person.

MFA and mail hygiene (aggregate only). From your identity admin console, track percentage of accounts with MFA enabled and whether dangerous mail forwarding rules were removed after the last review. Trend by month, never per person in management slides.

• Quarterly count of internal phishing reports plus median response time
• Rolling twelve-month training coverage (live, e-learning, onboarding)
• Finance verification steps on IBAN changes, logged without names
• Short notes after near-misses with a dated action
• Optional five-question pulse in team meetings, not scored per individual

A made-up example

A made-up example: a 45-person logistics firm in Aargau runs one live session in March and logs completions for six new hires in September. They count fourteen internal reports in Q2 and twenty-two in Q3 after posting the report address on the intranet. Finance records eleven supplier IBAN changes; nine used the callback checklist. The owner reviews two numbers in a twenty-minute sit-down each quarter. No click leaderboard exists.

Metrics to use carefully

Simulation click rates may trend aggregated by department if staff were informed first and you never rank individuals. Pair simulation sends with report counts: more reports after a campaign can mean the channel works. See phishing simulations in Switzerland.

External fraud statistics such as the BACS half-year report describe environment risk; they do not score your firm.

What measuring is not

It is not spyware on keyboards. It is not a KPI tied to bonuses without checking collective agreements and co-determination rules. It is not proof you will never be breached.

ISO/IEC 27001:2022 control A 6.3 expects evidence of programme effectiveness. Interviews plus attendance often satisfy auditors better than a single percentage on a slide. Mapping to A 6.3 can be prepared on request; the session does not certify the company.

Who can keep it minimal

Below twenty staff, a spreadsheet with training dates, onboarding notes, and a tally of reports may be enough until a customer audit demands more. Store it where the next office lead finds it.

When numbers should trigger action

If reports drop to zero while mail volume is unchanged, people may have given up reporting. If IBAN callbacks never happen while finance processes many supplier changes, your rule exists only on paper. If training happened once three years ago, do not paste old attendance into a new questionnaire. If MFA coverage stalls below your policy target for two quarters, fix enrolment before the next simulation.

Documentation auditors ask for

Keep it simple: calendar invite or sign-in sheet, slide title list or one-page summary, facilitator name, and language used. Store insurer questionnaire answers beside the same folder. If you map to ISO/IEC 27001:2022 control A 6.3, keep the mapping letter separate from attendance.

Link training to measurement

After security awareness training topics are delivered live, schedule the five-question pulse two months later. Tie examples to the same report mailbox IT monitors and the same IBAN steps finance uses in ERP. When processes change, send a one-page update rather than waiting a year.

Working with your IT partner

Most SMEs deliver training with an external facilitator while IT owns mail rules and MFA. Agree who sends reminders, who collects attendance, and who answers report mail after the session. Without ownership, annual training becomes an HR calendar entry that IT never hears about.

Swiss context reminders

Fraud dominates public reports to BACS; payment and CEO-style requests belong in every annual slot even if last year was “only” phishing links. The cyberattack reporting duty for critical infrastructure does not apply to most SMEs; do not confuse staff with BACS 24-hour rules unless you know you are in scope.

Respect labour and privacy limits

Inform staff before simulations. Do not use awareness metrics for hidden performance scoring. Art. 26 ArGV 3 and Art. 328b OR frame monitoring; this is orientation, not legal advice. Link EDÖB guidance on workplace monitoring and SECO commentary on Art. 26 ArGV 3 when HR asks.

Practical close

Pick two metrics for the next quarter only: for example report volume with response time, plus rolling training coverage. Review them in a short management sit-down. For a live programme with follow-up conversation built in, see Security Awareness Training.