Security Culture Survey: Run One Before 2026 Training
Run a security culture survey before launching training in 2026. Seven steps to segment departments by risk, score tiers, and cut wasted training seat-time.
DefendWise
DefendWise
A security culture survey run before training tells you which departments already flag suspicious emails and which ones will click anything with "invoice" in the subject line — skip it and you're building a 2026 curriculum on guesswork.
TL;DR
- Run a security culture survey before training launches to cut wasted seat-time on modules employees already know.
- Ten to fifteen Likert-scale questions with department-level tags beat individual name tracking.
- Score responses into three tiers so high-risk departments get remedial phishing modules first.
- Re-survey at six and twelve months to prove behavior shift, not just completion percentages.
Why this matters
Most security awareness training rollouts start with a module assignment, not a diagnosis. That's backwards.
A security culture survey gives you a baseline: how employees actually perceive risk, whether they know how to report a phishing email, and which departments treat security policy as optional. Without it, an MSP assigning training to every subclient user runs the same 40-minute course for the finance team that ignores urgency-based emails and the warehouse crew that has never been phished at all. That's wasted time and it shows up in low completion rates by month two.
DefendWise clients running security awareness training under a flat $399/month fee don't pay more to survey first — unlimited seats means the diagnostic step costs nothing extra in licensing. The only cost is the 15 minutes it takes to build the survey and the day it takes to collect responses.
What you'll need
- A simple form tool (Google Forms, Microsoft Forms, or a built-in survey feature) — no dedicated survey software required
- A roster of employees mapped to department or subclient, since scoring by group is the whole point
- 10-15 draft questions covering reporting behavior, password habits, and response to urgency
- A 48-hour distribution window plus one reminder cycle
- A place to log results by tier — a shared spreadsheet works for a single client, while a security-first culture program with role-based reporting scales across dozens of subclients
The steps
1. Define what culture means for this rollout
Pick three or four behavior categories before you write a single question — phishing reporting, password reuse, device sharing, and response to urgent requests cover most of what drives incident rates. Naming the categories up front stops the survey from turning into a 30-question grab-bag nobody finishes.
Common mistake: trying to measure everything at once. A survey with 25 items gets abandoned halfway through; one with 12 gets finished.
2. Draft 10-15 questions using a Likert scale
Yes/no questions produce flat data — everyone says yes to "I know how to spot phishing." A five-point agreement scale, 1 for strongly disagree through 5 for strongly agree, exposes gradients. The statement "I would forward a suspicious invoice to IT before clicking anything" gets far more honest spread than "Do you know what phishing is?"
Mix in one or two scenario-based items. Describe a fake DocuSign request or an urgent wire-transfer email and ask what the employee would do. Scenario responses track actual click behavior more closely than self-rated confidence does.
3. Segment the distribution by department, not by individual
This step matters more for MSPs managing multiple subclients than for a single-org rollout. Tag every response with department and location, never a name. That's how you spot the pattern that matters, and it feeds directly into segmenting phishing simulations by department risk level once training starts.
Common mistake: tying responses to named employees. Anonymity is what gets you honest answers instead of the answers people think IT wants to hear.
4. Distribute with a tight window and one reminder
Send the survey link with a 48-hour deadline and a single reminder at the 24-hour mark. Longer windows don't raise completion — they just let the survey sit unopened in a crowded inbox. Aim for 70% response as a workable threshold; anything under 50% means the results are too thin to build a 2026 training plan on.
5. Score responses into three tiers
Green, yellow, red — label them however you want, but turn Likert averages into one action bucket per department. A department averaging under 3.0 on urgency-response and reporting items is your first training priority for 2026, not your last.
This is the same logic behind scoring your organization's cyber security readiness. The survey is a lighter-weight version of that assessment, built to sequence training rather than produce a compliance document.
6. Map survey tiers directly to training assignment
Red-tier departments get remedial phishing modules and a shorter simulation interval in month one. Green-tier departments start on standard cadence. This is where the survey earns its keep: instead of assigning identical training to a 500-person org, you assign by measured risk, which cuts the number of employees sitting through content they don't need.
7. Re-run the survey at six and twelve months
A one-time survey tells you where to start. A repeated survey tells you whether training worked. Compare tier movement at the six-month mark against benchmarked phishing susceptibility rates pulled from simulation data. If self-reported culture scores improve but click rates don't move, the training content is the problem, not the survey design.
Deploy training by risk tier today
One flat fee, unlimited seats, no per-user math after the survey.
Troubleshooting
- Response rate under 40% — cut the survey to 8 questions and send it from a named person, not a generic IT alias.
- Answers look uniformly high, everyone scores 5 out of 5 — swap self-rated confidence questions for scenario-based ones. People inflate confidence; they don't inflate scenario responses the same way.
- A department pushes back on being surveyed — frame it as a baseline for lighter training, not an audit. Departments that score well get less mandatory content, not more scrutiny.
- Subclient owners resist sharing results with an MSP — present tier data in aggregate, never by named employee, and tie it to reduced training hours for their staff.
- Survey timing overlaps a phishing simulation launch — run the survey at least one week before the first simulated phishing email goes out so results aren't skewed by a recent click event.
- Two departments tie on score — break the tie with headcount and data access, and train the group touching payment or payroll systems first.
Tools and resources
- A basic form tool for the survey itself — Google Forms or Microsoft Forms is enough
- Cyber security readiness scoring for a heavier assessment once the survey flags weak departments
- Department-level phishing simulation segmentation to act on survey results
- Phishing susceptibility benchmarking to validate the survey against actual click data
- A security awareness training platform that assigns modules by tier instead of by flat roster — a $399/month flat fee only pays off when the training itself is targeted
What to do next
Once tiers are set and training is assigned, the next problem is proving the shift to a client or leadership team that wants numbers, not a survey summary. The security-first culture guide linked above covers what happens after the first 90 days of 2026 — how survey data, simulation results, and reporting behavior combine into evidence of a real culture shift instead of a completion percentage.
FAQ
What is a security culture survey?
A security culture survey is a short questionnaire measuring how employees perceive and respond to security risk before formal training starts. It covers phishing reporting habits, password behavior, and response to urgent requests, scored by department rather than by individual.
How many questions should a security culture survey have?
10 to 15 questions is the workable range for 2026 rollouts. Fewer than 8 misses key behavior categories; more than 20 drops completion rates below a usable threshold.
Should security culture survey responses be anonymous?
Yes, tag responses by department or location, not by name. Anonymous responses produce more honest self-reporting, especially on questions about past mistakes.
How long should the survey window stay open?
48 hours with one reminder at the 24-hour mark gets the strongest response rate. Longer windows do not improve completion, they just let the link sit unopened.
How often should you re-run a security culture survey?
Re-run it at six and twelve months after the initial training launch to measure tier movement. Comparing results against phishing simulation click rates over the same period shows whether training changed behavior.
Can a security culture survey replace phishing simulations?
No, it is a diagnostic step that comes before simulations, not a replacement. Simulations measure actual click behavior; the survey measures self-reported attitudes and sequences which departments get remedial training first.
What is a good response rate for a security culture survey?
70% or higher gives a usable dataset for tier scoring. Below 50%, the sample is too thin to justify department-level training decisions.
Does survey data affect training costs for MSPs?
Under a flat-fee model like the DefendWise $399/month unlimited-seat pricing, survey-driven segmentation does not change licensing cost. It changes how training time gets allocated across departments.
One last thing
The department that scores worst on a security culture survey is rarely the one an MSP expects going in. Finance and accounting teams routinely underperform on urgency-response items because their daily workflow already involves rushed, high-stakes payment requests that look almost identical to a business email compromise attempt. Survey them before you assume the warehouse floor is your 2026 risk problem.