A security awareness programme manager needs to move beyond counting training completion rates and phishing click rates, and instead demonstrate measurable human risk reduction to leadership. The challenge is designing a measurement model that isolates the programme's effect, identifies high-risk employee segments, and produces evidence-based recommendations for targeted interventions.