"A baseline survey nobody dares to discuss is not a measurement but a reckoning." Many awareness programmes start with a baseline survey: a phishing test, a knowledge quiz or a culture scan. On paper that sounds sensible. After all, you want to know where you stand. But in practice there is a big risk in the way that baseline is used.
The real problem: measuring without trust
When a baseline survey is used to call people to account, fear arises. And fear is the worst teacher there is. Employees who are afraid of making mistakes behave differently during the measurement than in real life. They become more careful, more alert, more attentive — precisely during the test. As a result you do not measure their real behaviour, but their test behaviour.
And as soon as the measurement is over, everything sinks back. You then have a nice report, but no reliable picture. Worse still: you have damaged trust. People feel caught instead of helped. And an organisation that feels caught starts to hide instead of learn.
A baseline only works when it feels safe
A good baseline survey starts with a promise: this measurement is to learn, not to call people to account. No names, no rankings, no consequences for individuals. Only then do you see honest behaviour, and only then is your measurement worth anything.
When employees know a baseline is meant to help the organisation, not to call them out personally, they take part. Then someone clicks a phishing link and thinks: "Good that I learn this now, instead of in a real attack." That is exactly the behaviour you want to see: learning without shame.
The figures from such a safe measurement are also far more valuable. They show how people really behave, not how they behave when they know they are being watched. And on the basis of those real figures you can build a programme that works.
From reckoning to starting point
The baseline should be a starting point, not a final verdict. It is the photo of today, not the employee's report card. When you communicate that well, the whole dynamic changes. People become curious instead of defensive.
So always communicate beforehand why you measure, what you do with the results, and above all what you do not do with them. Promise that there are no individual consequences, and keep to it. Because the most important thing in awareness is not the measurement itself, but the trust underneath it. Without that trust you measure nothing that matters.
Related articles
FAQ
Are you allowed to make a baseline anonymous?
Not only allowed, it should be that way. Aggregated figures per department or role give enough steering without pointing at individuals.
How do you communicate a baseline beforehand?
Short and honest: 'We measure where we stand, to improve the programme. No names, no consequences.' Trust creates honesty.
What if management does want to see names?
Explain that names break the measuring instrument: people start showing test behaviour. You lose your baseline and the trust.
How often do you repeat a baseline?
Annually as a trend measurement, with the same safe agreements. That way you see movement without harming people.