Measuring security culture without turning it into surveillance

Measure security culture with aggregate data about conditions, such as capability, opportunity and motivation, and with behavior signals like time to report. Keep individual results private, report only at team level, and never use them for hiring, promotion, discipline or access control. That is the OWASP project's explicit limit.

What culture measurement is for

You want to know why secure practices do or do not happen. The OWASP Security Culture project describes a framework called SECUR-E, built on COM-B and DASP research, which asks whether a practice is held back by capability, opportunity or motivation. Each leads to a different fix.

If people lack capability, train them. If they lack opportunity, change tools or time. If they lack motivation, look at incentives and leadership signals.

How the OWASP approach is structured

According to the project page:

• A 24 item survey with 3 reflections feeds scoring into capability, opportunity and motivation bands.
• Results map to a pattern with a confidence level, shown as individual or aggregate profiles.
• Personas describe present circumstances, not permanent labels.
• Individual results are private by default, and team reporting is aggregate.
• Reassessment is planned after 3 to 6 months.
• The framework is described as under expert review and community testing, so treat it as evolving.

Behavior signals you can add

Survey data tells you how people feel. Behavior data tells you what they do. Useful signals that do not single people out:

• Median time from suspicious message to report.
• Share of security reviews requested before launch rather than after.
• Time from vulnerability finding to fix, by team.
• Number of voluntary questions to the security channel.

Rules to adopt before you start

1. Write down who sees what. Individual data goes to the individual only.
2. Set a minimum group size for team reports, so nobody can be identified.
3. State in writing that the data will not be used for performance decisions.
4. Tell people why you are asking and what changed after the last survey.

What to do with results

Pick the weakest band and one intervention. For a capability gap, run a lab. For an opportunity gap, remove a step that makes the secure path slow. For motivation, check whether leaders talk about security in planning meetings. Then reassess in a few months.

Warning signs

If staff start gaming answers, the survey has lost trust. If managers ask for names, stop and reset the rules. If nothing visibly changes after two rounds, people will stop answering.

Quick check

Sources

• OWASP Security Culture project

Last reviewed: 19 October 2026.