We track phishing click rates, how many people report suspicious emails, how quickly they report, and how awareness trends by department. You get clear evidence of improvement over time, which is exactly what your board, auditors and cyber insurers want to see.
