Which of the following is most important for measuring effectiveness of the security awareness program?