Behavioral KPI

A behavioral KPI is a key performance indicator that measures what employees actually do across the digital workplace — sharing files publicly, granting OAuth scopes, approving MFA pushes, reusing passwords, dwelling on suspicious emails — rather than what they completed in an LMS or how they performed on a single simulated-phishing test. Behavioral KPIs are the operational language of Human Risk Management, the same way MTTR and detection coverage are the operational language of the SOC.

The contrast with legacy Security Awareness Training metrics is sharp:

• SAT metric: completion rate. Tells you who watched the video. Says nothing about subsequent behavior.
• SAT metric: click rate on simulated phish. Tells you a single snapshot under unrealistic conditions, and tends to degrade as a measure the moment it becomes a target — see Goodhart’s Law.
• Behavioral KPI: risky-share rate per 100 active users. Counts how often the workforce shares sensitive files “anyone with the link” per week, trended over time.
• Behavioral KPI: OAuth-grant-to-revoke median time. Measures how fast the org reacts when an employee gives a third-party app excessive scope.
• Behavioral KPI: MFA-fatigue approval rate. Counts unjustified MFA push approvals — the leading indicator of the attack family that broke Uber and Cisco in 2022. See MFA fatigue.

A well-designed behavioral KPI shares five properties:

• Behavior, not knowledge. Counts a thing the employee did, not a thing they recalled.
• Trend, not snapshot. Shown as a time series so reduction is visible and statistically meaningful.
• Owner-scoped. Broken down by team, department, or employee so accountability lands somewhere.
• Auditable. Each datapoint resolves to a timestamped observation that becomes behavioral evidence for NIS2, SOC 2, or GDPR Article 32 reviews.
• Goodhart-aware. Paired with a counter-metric (e.g. false-positive nudge rate) so optimizing the headline number does not silently push risk elsewhere.

Behavioral KPIs only make sense once you have a behavior baseline — the read of where the workforce is today, before any intervention. Without the baseline, every KPI movement is noise.

Engarde (engarde.cc) treats behavioral KPIs as first-class objects in the platform: they are the metrics the CISO presents to the executive committee, and the metrics the auditor reads when asking what the human-risk control actually does.