What Your SOC Data Tells You About Your People: Using Telemetry to Target Security Awareness

October is Cybersecurity Awareness Month, and European Cybersecurity Month, coordinated by ENISA, runs across the same weeks. Many organisations mark the month with a fresh round of training modules and phishing simulations. Much of that effort is generic. Everyone gets the same content, whatever risks they face.

Your SOC already holds a detailed picture of how people behave. Sign-in patterns, reported phishing, blocked downloads and policy alerts all show where human risk sits. Putting this data to work turns awareness from a calendar event into a targeted, year-round programme.

The Data You Already Hold

Several sources in your SOC are useful to an awareness team:

• Email security logs, showing which teams receive the most malicious email and which lures get past filtering.
• Phishing report data, showing who reports suspicious messages, how quickly and how often those reports turn out to be real threats.
• Identity telemetry, including repeated MFA fatigue prompts, risky sign-ins and unusual password reset patterns.
• Web and data loss prevention alerts, such as attempts to upload files to personal storage or unapproved AI tools.
• Endpoint alerts, covering blocked macros, unapproved software installs and USB use.

None of this requires new tooling. It needs your SOC and your awareness team to talk to each other.

Put Reporting Rates at the Centre

Click rates from phishing simulations are the most common awareness metric. On their own they’re a weak one. A low click rate tells you people avoided a single test. A high, fast reporting rate tells you people are helping defend the organisation.

Your SOC data shows how people respond to real threats as well as simulated ones. Track how many malicious emails staff reported before your tools caught them, and how long those reports took. This shows your people acting as an early warning system, and it’s a number your board will understand.

Give Your Board a Clearer Picture

Board members often ask about human risk, and training completion rates rarely answer the question. Completion tells you people clicked through a module. Telemetry tells you whether behaviour changed.

A short quarterly view works well. Show real phishing reports, median time to report and the trend in risky sign-ins, set against the targeted sessions you ran. Keep the numbers at organisation and team level. When a figure moves, explain what you did and what you plan to do next.

Target the Teams Under Pressure

Telemetry often reveals patterns an awareness team would otherwise miss. Finance might receive most of the invoice fraud attempts. A single office might generate a cluster of risky sign-ins from personal devices. A project team might be pasting client data into an unapproved AI tool.

Each pattern points to a specific, short intervention. A 10 minute briefing for the finance team on payment change requests. A conversation with the office about device use. Clear guidance on which AI tools are approved. Short, relevant sessions land better than long, generic ones.

Keep the Approach Supportive

Telemetry is personal data, and how you use it matters. Share trends at team level rather than naming individuals. Tell staff what you monitor and why. Frame findings as support rather than blame. People who fear punishment stop reporting mistakes, and silence is the worst outcome for any SOC.

Speak to your data protection officer before using security telemetry for awareness work and check your privacy notices cover this use.

Close the Loop with Your SOC

Awareness and security operations work best as a single feedback loop. The SOC spots a new lure or behaviour pattern. The awareness team turns it into a short, timely message. The SOC then watches whether reporting improves and risky behaviour drops.

Good data makes this practical. When your email, identity and endpoint logs are normalised and searchable in a single place, pulling a monthly human risk view takes minutes rather than days.

Getting Started This October

• Pick 3 metrics from your SOC data, for example real phishing reports, time to report and risky sign-ins per team.
• Agree a monthly review between your SOC lead and your awareness lead.
• Choose 1 team with a clear risk pattern and run a targeted session with them.
• Compare the numbers at the end of November and share what changed.

Awareness month lasts 31 days. The data your SOC collects keeps working all year.

Get In Touch

If you would like to talk through any of the points in this article, our team is happy to help. Visit hoopcyber.com/contact or email .