If Completion Rates Don’t Prove Anything, What Does? Why Security Programs Stall Without Real Behavior Change

About this episode

The episode discusses the shortcomings of completion rates in security training and explores effective metrics for measuring real behavior change.

Episode #5 “We have 100% completion… but nothing’s changed.” It’s a complaint security leaders are making louder and more often. Completion rates are being called “cosmetic,” “misleading,” and “just optics” - metrics that check the compliance box but fail to reduce real human risk. In this episode, host Eliot Baker sits down with Maxime Cartier , Head of Human Risk at Hoxhunt, to unpack what organizations are getting wrong about measurement and what the most mature programs are doing instead. Drawing from Maxime’s recent insights at the SANS Security Awareness Summit, this conversation cuts through outdated KPIs and explores what actually signals behavioral change. You’ll hear what practitioners are building in the real world, how to bring leadership along without losing them in complexity, and how to measure success beyond tick-box numbers. This isn’t theoretical - it’s tactical guidance from a field that’s evolving fast. What you’ll learn in this episode: Why 100% training completion doesn’t mean behavior has changed How to spot “vanity metrics” and what to replace them with Why security programs are borrowing measurement models from public health and road safety What early…

People in this episode

Host: Eliot Baker

Guest: Maxime Cartier

Topics covered

• human risk management
• security programs
• behavior change
• metrics
• KPI

Keywords

• completion rates
• vanity metrics
• public health
• road safety
• behavioral change

More episodes of All Things Human Risk Management

• Your Security Awareness Program Has Plateaued - What Happens Next? · March 12, 2026 · 1h 2m
• The Ethical Guide to Security Storytelling: Navigating Real Breaches with Care and Respect · February 2, 2026 · 34 min
• The Attacks Getting Through Your Filters (and How AI Is Scaling Social Engineering) · December 22, 2025 · 38 min
• Does Security Awareness Training Even Work? Fixing the Flaws Behind “Training Fails” Headlines · November 16, 2025 · 38 min
• State of Phishing 2025: Why SVGs Spiked (and What Still Works) · October 30, 2025 · 46 min
• A CISO’s Playbook for Security Comms (with Jeffrey Brown) · October 14, 2025 · 53 min