Which of the following is most important for measuring the effectiveness of a security awareness program?