Which of the following metrics BEST demonstrates the effectiveness of an organization's security awareness program?

This metric indicates the *failure* of security controls and employee behavior, not necessarily the *effectiveness* of an awareness program, as infections can bypass awareness.

Training attendance measures participation, not necessarily understanding, retention, or behavioral change that translates into improved security practices.

An increase in reported security incidents (like suspicious emails, unusual system behavior, or potential policy violations) indicates that employees are more aware, vigilant, and understand their role in the security chain, actively identifying and escalating potential threats. This metric directly reflects improved employee behavior resulting from awareness training.

The number of phishing emails viewed doesn't indicate if employees recognize them as threats or how they respond, making it an insufficient measure of awareness program success.