Benchmark

What is it for?

• Know whether the organization is above or below the industry average in key security metrics

• Identify which indicators need improvement and which ones the company already excels at

• Provide comparative context to justify investment decisions in awareness programs

When to use it?

• After a campaign cycle — to assess whether the actions taken improved the metrics relative to the average

• When defining priorities for the next period — to decide which metrics to focus efforts on

How is it used?

Navigation: Insights → Benchmark

1. View the benchmark summary

   Upon entering, the Benchmark Summary is displayed with all the metrics compared against the selected industry. Each metric first appears as a collapsed row with its name and a status badge. Clicking on it expands to show the full detail.

2. Select the period Use the period selector to choose the time range you want to analyze. The available options are:

   • 3 months

   • 6 months

   • 1 year

   • Full history

   When you change the period, both the organization's own KPIs and the benchmark values update for that same range.

3. Choose the comparison reference

   You can compare yourself against the Whalemate global average or against your industry average. Both references are visible on screen simultaneously.

   If there aren't enough organizations from the same sector on the platform, the comparison is made against the total of Whalemate organizations. The organization itself is always excluded from the average calculation.

4. Read the status of each metric

   Each row shows a badge with three possible statuses:

   • Above benchmark (green) — the organization exceeds the industry average

   • Below benchmark (yellow) — the organization is below the average

   • At benchmark (blue) — the organization is in line with the average

5. Read the expanded detail of each metric

   Expanding a metric shows three values:

   • Current: the organization's actual value

   • Industry Avg.: the average of the selected sector

   • Delta: the difference between both (positive or negative)

   Below the values, an automatic description appears with the result and a contextual assessment (e.g., "Good job" or "Area for improvement"). Each metric also indicates whether the criterion is Higher is better or Lower is better, in order to correctly interpret the delta.

6. Available metrics

   • Cyber Risk Score ↓ Lower is better: the organization's overall risk score

   • Report rate ↑ Higher is better: % of employees who correctly reported simulations

   • Click rate ↓ Lower is better: % of employees who clicked on phishing simulations

   • Training completion ↑ Higher is better: % of employees who completed courses

     This metric is calculated at the close of each assignment's deadline: assignments whose deadline is still active are not counted until they expire, in order to avoid the rate appearing artificially low at the beginning of the period. It includes both standalone courses and courses that are part of Learning Paths.

   • Recurrence rate ↓ Lower is better: % of repeat-offender employees

⏳ Coming soon you will also be able to see the Learning Paths Completion (the LP as a complete program, not just its internal courses).

How to interpret the results?

• Cyber Risk Score below average → a positive sign. The organization has less risk than its industry peers. If it has also been decreasing over time, the program is working.

• Click rate above the benchmark → employees are falling for simulations more than the average. It is the most direct indicator of vulnerability and where it's worth focusing the next campaigns.

• Report rate below the benchmark → employees are not reporting suspicious simulations. Working on a reporting culture can improve this number without the need for more campaigns.

• Training completion below the benchmark → there are employees who are not completing assigned courses. Review the assignment, the difficulty, or the frequency of the courses.

• Negative delta in a "Lower is better" metric → is always positive. It means that the organization is doing better than average.

What to do based on what you see?

• All metrics above the benchmark → keep up the pace and use the results as evidence of impact

• One or two metrics below the benchmark → prioritize those metrics in the next cycle. Adjust the type of simulations or the course content depending on which one is failing.

• Majority below the benchmark → review the entire strategy. It may indicate that the campaigns don't have sufficient frequency or variety, or that the audience isn't well segmented.

🔜 Soon you'll be able to filter by country, and the reference baselines will be improved. If this feature is a priority for your organization, you can request it at roadmap.whalemate.com/roadmap.

🔜 Benchmark export will be available soon. If this feature is a priority for your organization, you can request it at roadmap.whalemate.com/roadmap.

❓ Frequently Asked Questions

• What is the organization compared against if there aren't enough companies in its industry?

If there aren't enough organizations from the same sector, the benchmark is calculated against the total number of Whalemate companies. The organization itself is always excluded from the average.

• What does the Delta mean?

It is the difference between the organization's current value and the industry average. A negative delta in a "Lower is better" metric (such as Cyber Risk Score) is positive, which means the organization is doing better than average.

• How often are the industry averages updated?

Industry averages and each organization's score are updated daily. The data is historical, so you can see the evolution over time.

• Can I see the benchmark by department or group?

The current view shows the benchmark at the organization level. Segmentation by group will be available soon.

• Is the Cyber Risk Score the same one that appears in the main dashboard Summary?

Yes, it's the same indicator. The Benchmark adds comparative context against the industry.

• Does Training completion include courses that are part of a Learning Path?

Yes. The metric considers both independent courses and courses that are part of a Learning Path.

💬 Do you have feedback on this feature or want to request improvements? Let us know at roadmap.whalemate.com/roadmap