DEFENSTORY · SAMPLE REPORT

Cybersecurity Training and Exercise Results Report

A sample report connecting training completion, response actions, and organizational improvements.

Fictional Case: Saebom TechExercise Period: Q3 2026Audience: Employees, Security Team, and Department ManagersReport Version: DEMO 1.0

← Back to Results Reports

1. Executive Summary

This sample exercise reviewed phishing impersonation response and incident reporting procedures. The fictional demo data assumes strong participation with room for improvement in reporting channel awareness and escalation between departments.

Training Completion94%235 of 250 assigned participants

Exercise Reporting Rate68%+18 percentage points vs. baseline exercise

Median Reporting Time4.2minImproved from the previous sample of 8.5 min

Improvement Actions Completed7/ 92 actions in progress

2. Exercise Behavior Analysis

These scores do not rank individuals. They illustrate how consistently the organization performed the actions required in each scenario.

Response Behavior Before and After · Sample

Authenticity Verification

Reporting Behavior

Containment

Role-Based Reporting

Gray blue: Before training　 Dark blue: After training

Performance by Action

Verify requests through a separate channel74%

Report suspicious messages68%

Hold information sharing and transfers86%

Report to managers and the security team61%

3. Results by Scenario

For lower results, review whether procedures, tools, and guidance worked in practice rather than attributing them to individual failings.

Scenario	Observed Metric	Sample Result	Interpretation	Recommendation
Transfer request impersonating an executive	Independent verification	74%	Participants attempted verification, but some did not know an alternative contact channel.	Publish verification procedures and contact channels for executives and business partners.
Email with a phishing link	Reporting rate / Median reporting time	68% / 4.2 min	Delayed reports involved difficulty finding the reporting button or responsible contact.	Pin a reporting menu in collaboration tools and acknowledge receipt.
Unusual activity after opening an attachment	Isolation and reporting	79%	In some departments, device isolation instructions conflicted with business continuity instructions.	Specify isolation authority and fallback work procedures in the role matrix.

4. Summary by Role

Audience	Strengths	Areas for Improvement	Recommended Next Training
All Employees	Some verification before transferring funds or sharing information	Awareness of reporting channels and follow-up procedures	Phishing and messaging scam microlearning
Security and IT Teams	Decisions to block accounts and review logs	Progress updates after user reports	Initial response and incident communication practice
Team and Department Managers	Work prioritization and checking on team members	Duplicate or missing reports to security and business units	Role-based tabletop exercises
Executives and Leadership	Deciding whether to maintain critical services	Responsibility and timing for external announcement approval	Crisis decision-making workshop

5. Improvement Action Register

Turn observed issues into actionable tasks and track owners and review dates.

Completed · Security TeamAdd phishing reporting channels to email and collaboration tools

Verification: Measure reporting time and rates again in the next exercise.

In Progress · IT OperationsClarify incident isolation authority and fallback work procedures

Verification: Review departmental role matrices and service recovery priorities.

Planned · HR and SecurityAdd impersonation cases to new employee security training

Verification: Include these cases in next quarter’s new employee assessments.

6. Metric Definitions and Interpretation

Metric	Example Definition	Interpretation Notes
Completion Rate	Participants meeting completion criteria divided by assigned participants	Do not assess actual response capabilities from completion rates alone.
Reporting Rate	Share of exercise message recipients who reported through the designated channel	Consider exercise difficulty and accessibility of reporting tools.
Reporting Time	Median time from message delivery to receipt of a report	Include the median, which is less sensitive to extreme values than the mean.
Action Performance	Share of required actions completed in each scenario	Specify observation items and assessment criteria for each course.

This document uses a fictional company and fictional figures to illustrate the interface. It is not actual performance data. Operational reports specify the audience, period, exercise difficulty, data usage purpose, and access permissions.