How to Measure Human Risk Management Across MSP Subclients

Human risk management across MSP subclients means tracking phishing click rates, training completion, and repeat-offender patterns per subclient — not averaging everything into one meaningless company-wide number. DefendWise rolls this up automatically across every subclient tenant at a flat $399/month, so an MSP with 40 subclients and 2,000 end users isn’t paying per seat to see who’s actually improving. The rest of this guide walks through the exact steps to build a measurement system that produces audit-ready evidence instead of a vague “security posture” slide.

Most MSPs measure human risk the way they measure uptime: one dashboard, one score, done. That works for infrastructure. It falls apart with people, because risk isn’t uniform across subclients — a 12-person law firm and a 300-person manufacturer have completely different click rates, completion patterns, and repeat-offender problems. This guide covers what to track, how often, and which tools make the rollup possible without adding a spreadsheet to your Friday afternoon. The method below reflects how MSPs managing dozens of subclients actually structure their reporting in 2026, not a theoretical framework.

What you’ll need

A human risk management platform that supports multi-tenant subclient views, not just one flat user list
A phishing simulation cadence already running for at least 60 days (you need a baseline before you can measure change)
Admin access to each subclient’s directory sync (Microsoft 365 or Google Workspace, typically)
A defined “repeat offender” threshold (most MSPs use 3+ failed simulations in a rolling 90 days)
A reporting template your account managers can hand to subclients without editing it first

Step 1: Separate per-subclient baselines before you compare anyone

This step establishes what “normal” looks like for each subclient individually, before any cross-client comparison happens. Skipping this is the single biggest reason human risk scores get ignored by subclients — a 22% click rate means something different for a 10-person firm than a 200-person one, and lumping them together produces a number nobody trusts.

In your platform’s subclient or tenant view, pull 90 days of phishing simulation results per subclient and record the click rate, report rate, and completion rate for assigned training modules separately for each one. Do not average across subclients at this stage. If you’re running DefendWise, this view is already segmented because the platform is built multi-tenant from the ground up — each subclient gets its own risk score without you building a filter first.

Expected outcome: a baseline table with one row per subclient showing click rate, report rate, and training completion rate. Common mistake: averaging all subclients into a single “book of business” score before baselines exist — that number hides the two or three subclients driving most of your actual risk exposure.

Step 2: Define the repeat-offender threshold per subclient

This step turns raw click data into an action list instead of a static report. A single click means little; a user who clicks on three consecutive simulations over 90 days is the actual security gap worth a conversation with the subclient.

Set the threshold at 3+ fails in a rolling 90-day window as a starting point, then adjust per subclient based on size — a 15-person firm with one repeat offender has a different risk profile than a 200-person firm with the same raw count. Tag these users in your platform so they surface automatically rather than requiring a manual cross-reference every reporting cycle.

Expected outcome: a named list of repeat offenders per subclient, refreshed automatically each reporting period. Common mistake: setting one universal threshold across all subclients regardless of size, which either buries risk in large subclients or over-flags small ones.

Step 3: Track training completion against assigned deadlines, not just enrollment

This step accomplishes a shift from “did we assign training” to “did people finish it on time,” which is the metric cyber insurance carriers and compliance auditors actually ask for.

For each subclient, record the percentage of assigned users who completed training within the deadline window versus those still pending or overdue. Pending-but-not-overdue is a different risk category than overdue-and-ignored, and your subclient report should separate the two. Unlimited-seat platforms matter here specifically because seat-count friction is what causes MSPs to under-enroll low-risk users just to control cost — and those are often the users who end up least trained.

Expected outcome: a completion-rate column per subclient broken into on-time, pending, and overdue. Common mistake: reporting only “enrolled” numbers, which tells a subclient nothing about actual exposure.

Step 4: Build the per-subclient trend line, not a snapshot

This step converts a single reporting period into a trend subclients can act on. A 15% click rate means nothing without knowing whether it was 25% two quarters ago or 8% two quarters ago.

Pull click rate, report rate, and completion rate for each subclient across at least three consecutive reporting periods (quarterly works for most MSPs). Chart the trend, not just the latest number. DefendWise retains this history per subclient automatically, which matters when a subclient asks for 12 months of evidence ahead of a cyber insurance renewal or a compliance audit tied to frameworks like HIPAA or PCI DSS.

Expected outcome: a three-point (minimum) trend line per subclient showing direction, not just a current-state number. Common mistake: reporting only the most recent quarter, which looks identical whether risk is improving or getting worse.

Step 5: Package the rollup into a subclient-facing evidence report

This step turns internal metrics into something a subclient’s compliance officer, cyber insurance-broker, or auditor can actually use without a follow-up call.

Export each subclient’s baseline, repeat-offender list, completion trend, and simulation history into a single document, white-labeled under the subclient’s name rather than the MSP’s or the platform’s. This is the document that gets attached to a cyber insurance renewal application or handed to an auditor asking for human risk management evidence. Platforms that generate this automatically per subclient save the hours that otherwise go into manually compiling CSVs every reporting cycle.

Expected outcome: a ready-to-send PDF or report per subclient, no manual formatting required. Common mistake: sending the MSP’s internal dashboard screenshot instead of a clean, subclient-branded evidence document — it reads as unfinished work to anyone outside the MSP.

Troubleshooting and common mistakes

Problem: one subclient’s numbers always look worse, no matter what. Check headcount and industry first — a 400-person healthcare subclient will naturally show more raw repeat offenders than a 20-person firm. Compare rate, not raw count.

Problem: completion rates stall around 60-70% every quarter. This usually means training assignment isn’t tied to onboarding. Check whether new hires at the subclient are auto-enrolled or added manually — manual enrollment is where completion gaps start.

Problem: repeat offenders never actually change. If the same users fail simulation after simulation with no intervention, the threshold is being tracked but not acted on. Escalate repeat offenders to the subclient’s management directly rather than just noting them in a report.

Problem: per-seat pricing is quietly inflating your cost to measure this properly. If adding more users to a subclient’s tenant changes your platform bill, you’ll find yourself under-enrolling low-risk departments just to control cost — which defeats the point of measuring risk across the whole subclient. Flat-fee platforms remove this incentive entirely.

Tools and resources

DefendWise — flat-fee, white-labeled security awareness training built for multi-tenant MSP use, $399/month for unlimited seats across subclients, with automated subclient-level reporting and repeat-offender tracking built in.
Your PSA or RMM platform — useful for pulling headcount and directory sync data per subclient to validate enrollment accuracy.
A shared reporting template — standardize the subclient-facing evidence document so account managers aren’t rebuilding it from scratch each quarter.

FAQ

What is human risk management for MSPs? It’s the practice of measuring and reducing the likelihood that an end user causes a security incident — tracked through phishing simulation results, training completion, and repeat-offender patterns, broken out per subclient rather than averaged across the whole book of business.

How often should MSPs measure human risk management per subclient? Quarterly at minimum, with phishing simulations running continuously in the background so completion and click-rate trends have enough data points to mean something.

Does DefendWise support reporting across multiple subclients? Yes — DefendWise is built multi-tenant, so each subclient gets its own baseline, repeat-offender list, and completion trend without the MSP needing to build filters manually.

Why does per-seat pricing make human risk management harder to measure accurately? Per-seat pricing creates an incentive to under-enroll lower-risk departments to control cost, which creates blind spots in exactly the subclients where risk is hardest to see. Flat-fee pricing removes that incentive.

What counts as a repeat offender in human risk management tracking? Most MSPs use 3 or more failed phishing simulations within a rolling 90-day window, adjusted down for smaller subclients where the same raw count represents a larger share of the user base.

Conclusion

Human risk management across MSP subclients only works when it’s measured per subclient, trended over time, and packaged into evidence someone outside the MSP can actually use. The five steps above — baseline, threshold, completion tracking, trend building, and packaging — turn a vague “security posture” conversation into a report a subclient’s insurance-broker or auditor will accept without a follow-up call. In 2026, with cyber insurance applications asking for more granular evidence than a one-line attestation, this per-subclient discipline is what separates MSPs billing for security awareness training from MSPs actually delivering it. DefendWise’s multi-tenant structure and flat $399/month fee make the rollup itself the easy part — the discipline in steps 1 through 5 is what makes the number worth reporting.