Why You Should Care About Your Organization’s Security Culture Score

Editor’s note: In recognition of National Cybersecurity Awareness Month this October, we are publishing a series of blog posts dedicated to educating and informing you about cybersecurity practices. This is the 14th in a series of posts. Below, you can find a list of links to the rest of the series:

• FBI’s Warning: How to Protect Yourself from AI-powered Schemes
• Stuck on Windows 10? Here Are Your Options After Support Ends
• Job Scam Texts are On the Rise: Here are 5 Red Flags to Watch Out For
• Balance in Cybersecurity: Lock the Doors Before Boarding the Windows
• What is a Vishing Scam and How Do I Protect Myself?
• The CIA of Data Security: What It Means and Why It Matters
• Top 3 Cybersecurity Trends We Uncovered from GrrCON 2025
• Why MDR is the Security Team Your Organization Needs
• BYOD for Smartphones: Balancing Security, Privacy and Cost
• Ransomware Is Getting Smarter: How AI Is Changing the Threat Landscape
• Numbers Don’t Lie: Phishing Training Works
• Phishing Attacks Can Now Mimic Your Organization’s Login Page
• Traveling for Work? Here are the Best and Worst Ways to Connect

Do you ever wonder if your employees are taking the right security measures?

Your employees might pass phishing training, but are they ready when the real threat hits?

That’s where the Security Culture Score comes in.

Your organization’s security is only as strong as your weakest employee. Security tools thwart many attacks, but phishing emails often bypass those tools. There’s a reason they are the No. 1 attack vector for hackers.

Because it’s the path of least resistance. It’s much easier to fool one person than it is to evade advanced security tools like spam filters, firewalls and intrusion detection.

So, we offer phishing awareness training to educate your employees on how to spot phishing emails. But how do you know if it’s actually working?

Let’s talk about the Security Culture Score, how it’s calculated and why it’s important.

Security Culture Score: A Guide to Reducing Risk

A Security Culture Score tracks the likelihood that an organization’s employees will accidentally share their credentials with an attacker.

Each organization is graded on a score of 0-100. The higher the score, the less likely employees will unknowingly share their credentials.

What’s the point of grading your organization? It acts as a baseline. We want to gauge your employees’ security knowledge, so we know what kind of training to provide.

Organizations that score in the excellent or good categories still need training, but it’s more about updating them on new and emerging trends while ensuring they are reminded of the basics.

Organizations in the mediocre to poor categories need to start with the basics, so we can eventually get them up to speed on new and emerging trends.

You should be aware of your organization’s Security Culture Score because, on average, employees in organizations with a good security culture are 52 times less likely to share their data because of a phishing email than organizations with a poor security culture.

Ultimately, a good security culture means your employees are doing their part to protect your organization from attackers.

Now that we know what the Security Culture Score is, how do we get this score?

Security Awareness Proficiency Assessment: What Do You Know?

Every new client we onboard and every new employee that begins employment with one of our clients must take the Security Awareness Proficiency Assessment (SAPA).

It provides you with an overview of where your employees are strong and where they’re putting you at risk regarding security.

There are no right or wrong answers; we just want to know how much your employees know about security.

Some sample statements on the SAPA include:

On a scale of never to always

• When I see an app that seems interesting or helpful, I verify it is approved by the IT department before I download it.
• When an email contains a link, I first hover over it and then check the URL of the website.
• When working remotely, I store work-related files on my personal cloud storage solutions.

On a scale of strongly disagree to strongly agree

• Antivirus software provides all the security protection our organization needs.
• I say I understand our organization’s information security polices, but I really don’t.
• My co-workers pay attention to information security only when they are monitored.

We provide this assessment once a year to see where improvements have been made and where more work is needed.

Your employee’s SAPA answers are tabulated using several dimensions of security culture — which include attitudes, behaviors, responsibilities and more — and your organization receives its Security Culture Score.

Stay Alert, Stay Secure

Do you know your organization’s security culture? Security-educated employees often are the difference between a failed and successful cybersecurity attack.

Don’t wait until a phishing email has wreaked havoc! Contact us to schedule a consultation to see how we can help secure your sensitive data with phishing training.

Stay updated! Get tips and insights delivered to your inbox weekly by subscribing to our newsletter.