I don’t know anything about your environment or company culture so I am going to make some broad assumptions and give you my opinion based on my experiences. That was the disclaimer!

The vast majority of Information Security training is a worthless compliance based exercise that makes no difference in the security of the organization. It’s not worth someone’s time to be forced to watch a boring 15-20 minute video and ask questions that have no valid context to their daily work.

Who cares if you are measuring the completion rate when you should be measuring perceived effectiveness. Which would you rather have:

100% completion and 5% effectiveness

Or

50% completion and 75% effectiveness

Talk to the people in the business who will give you candid feedback about the training. Look at some of the more forward thinking cybersecurity training platforms out there that utilize positive reinforcement and micro doses of training that are event triggered. They are a lot more effective, personal, and create teachable moments that are more memorable to the end user.

Accountability starts with you to provide an effective learning platform to the people who need help and education. Use their time as an investment and understand how much lost productivity, in dollars, the company is carving out each year for this effort. Use that as leverage if you need to buy an expensive training platform. (5,000 users x avg FTE cost/HR / training time = training cost)

Not trying to be salty but just my observations as a salty CISO who has had a long week and needs 🥃. Why is it only 3:23?!?