Observable
Metrics are tied to specific participant choices, not inferred personality traits.
METHODOLOGY
Measure the decision process, not just course completion.
CoMaSy turns scenario choices into defined training signals. The purpose is to make behavioural practice observable without pretending that a simulation score is a guarantee of real-world security performance.
Defined
Every metric has a written definition that can be applied consistently across scenario variants.
Comparative
Baseline and post-variant results are compared within a defined cohort and use case.
Bounded
Results are training evidence. They do not establish individual security competence or regulatory compliance.
CORE SIGNALS
What the dashboard is designed to show.
Pause Adoption
The participant interrupts the immediate action chain before committing to a consequential step.
Observed fromWhether the chosen response explicitly creates time or space to assess the request before acting.
Verification Rate
The participant verifies through an independent, known channel rather than relying on the channel that delivered the request.
Observed fromWhether the selected response uses a separate trusted source, process or contact path.
Impulse Rate
The participant chooses an immediate higher-risk action without sufficient independent verification.
Observed fromWhether the selected response commits the requested action, credential, payment, approval or disclosure too early.
H.A.C.K. Profile
The pattern of responses across Hurry, Authority, Comfort and Kill-Switch pressure mechanics.
Observed fromWhich pressure mechanism repeatedly produces weaker decisions across the scenario set.
PILOT MEASUREMENT FLOW
Baseline → practice → unseen variant → review.
- BaselineRun a defined scenario set before targeted practice.
- Targeted practiceRehearse the relevant pressure patterns and business workflows.
- Post variantUse unseen or materially varied scenarios so simple answer recall does not masquerade as improvement.
- ReviewCompare cohort signals, discuss limitations and decide scale / adapt / stop.
INTERPRETATION GUARDRAILS
What CoMaSy can support
- Repeated decision rehearsal
- Defined behavioural training signals
- Cohort-level comparison over time
- Pressure-pattern diagnostics
- Management-ready evidence from the pilot
What CoMaSy does not claim
- A guarantee that an employee will avoid a real attack
- A clinical or psychometric assessment
- A substitute for incident response, technical controls or policy
- Proof of regulatory compliance by itself
- A verified customer improvement percentage unless a real pilot produced it
NEXT STEP
Test the methodology with a bounded pilot.
Agree the cohort, risk focus, scenario set and decision criteria before scaling.