Focusing on
behaviours that
protect your people

The most meaningful security awareness metrics are behavioural ones. Are employees making fewer risky decisions, and is that improving over time? Track how often high-risk actions happen, whether that frequency reduces after an intervention, and whether people respond differently when the same situation appears again. Redflags brings awareness content, real-time nudges, behavioural monitoring and targeted campaigns together so teams can measure genuine risk reduction, not just engagement with training.

Redflags measures behaviour change by tracking what employees actually do before, during and after an intervention. For example, it can capture how often people upload files to public AI tools or copy sensitive content into unapproved sites, then show whether that behaviour reduces as the campaign runs.

The result isn’t an assumption that awareness led to change, but instead a measurable, evidenced correlation between the programme activity and a reduction in the risky behaviour it was designed to address. That is a fundamentally different level of confidence than completion rates or simulation pass rates can offer.

For practitioners, this is significant. It means you can demonstrate to leadership not just that a programme was delivered, but that it had a tangible impact on human risk. Over time, as multiple campaigns are tracked and compared, it becomes possible to build a robust evidence base showing how your organisation’s risk profile is shifting as a result of your security behaviour management programme. 

Behaviour metrics help boards see human risk in the language they care about: whether it is increasing, decreasing, and what is being done to manage it. Instead of reporting that employees completed a module, practitioners can show that a targeted intervention reduced a specific risky behaviour, how trends are shifting over time, and where further investment may be needed. For regulated organisations, that strengthens both the risk and compliance narrative.

Yes. Redflags includes an on-host tracker that identifies risky behaviour directly at the point it occurs, rather than relying solely on self-reported data or generic risk assumptions. 

This gives practitioners visibility into who is engaging in risky behaviour and how often, which makes it possible to segment your workforce by actual risk rather than by job title or department alone. Individuals or teams who are repeatedly triggering nudges for a particular behaviour can be identified and given more targeted support, whether that is additional awareness content, a more direct intervention, or closer monitoring over time. 

This segmentation capability sits at the heart of the Assess / Target stage of an effective Secure Behaviour Management workflow, helping practitioners prioritise the people and teams who pose the greatest risk, such as those with elevated access or a pattern of risky activity, rather than treating the whole organisation as a single uniform audience.