The 4.1% That Settled the Room. And the 11.7% Nobody Computed.

Phishing failure rate: 4.1%. That is the number that lands in the board deck, sits next to a green arrow, and settles the room. It is the kind of figure that lets a security program breathe out. Then someone filters the same test by the population that can move money, and the number becomes 11.7%. Filter again by administrators with production console access, and it gets worse. The test did not change. The people did not change. Only the question changed, and the answer inverted.

The Comfort Blanket Problem

This is the pattern we keep running into with awareness data. The aggregate metric is not wrong, but it is engineered, often unintentionally, to look reassuring. Averaging across ten thousand employees flattens the risk of the two hundred who actually matter. A finance clerk clicking a simulated lure is a coaching moment. A treasury approver clicking the same lure is a wire fraud incident waiting for a calendar invite. When those two events are counted with equal weight, the resulting rate tells the board about training completion, not about exposure. It is a comfort blanket stitched from real data.

The Dimension That Changes the Answer

The fix is not a better phishing simulation or a more aggressive training cadence. The fix is the dimension you cut the metric by. Slice by entitlement group and the story becomes decision-grade. Payment system holders at 11.7%. Domain administrators at a rate we have seen exceed 15% in mid-sized enterprises. Executive assistants, who often hold delegated access to calendars, inboxes, and approval workflows for the highest-value targets in the company, routinely fail at rates two to three times the org-wide average. None of this is visible in the headline. All of it is visible the moment you join the awareness dataset to the identity and entitlement graph.

Why the Join Never Gets Made

The reason this join rarely happens is organizational, not technical. Awareness data lives in the security awareness platform. Entitlements live in IAM, in the ERP, in the cloud provider, in the privileged access tool. Those systems report into different owners, on different cadences, into different views. The awareness team reports a rate. The IAM team reports a count of privileged accounts. Nobody reports the intersection, because the intersection does not belong to anyone. And so the most important number in the deck, the failure rate weighted by what someone can actually do, is the one number that never gets computed.

A Click Is Not Soft Data

We treat awareness data as soft data because of where it comes from, not because of what it measures. A click on a simulated lure is a behavioral signal about a specific human with a specific set of privileges attached to a specific set of systems. That is not softer than a CVE score. It is arguably harder, because it is observed rather than inferred. The same metric, labeled by blast radius, becomes a risk indicator you can defend line by line in front of an auditor, a regulator, or a board that has learned to ask sharper questions.

Where the Number Belongs

The operational move is to put awareness data in the same computation layer as vulnerabilities, entitlements, and blast radius. Not in a sibling view, not in a quarterly slide, but in the same query surface your risk team already uses. One number, cut by the dimension that changes the meaning, is worth more than a hundred aggregates. That is the pattern we build for at Metric Maestro, and it is the pattern that keeps your security numbers standing when the board asks the second question. If you want the query template we use to slice awareness metrics by entitlement group, reach out and we will send it over.