Discover which security awareness metrics prove real behaviour change, from phishing reporting rate to repeat-risk cohorts and board-ready dashboards.