Acceptance criteria
Record whether a warned user cancels, edits, redirects or proceeds, and calculate a remediation rate where privacy allows.
Why it matters
Self-remediation shows whether coaching changes behavior or just records it.
How to verify
Share of coached pilot interventions where the employee edits or cancels, and the trend over the pilot.
OWASP adoption context
Shadow, embedded-assistant and integrated-platform interactions are primary contexts for observing whether employees cancel, edit or proceed after a warning.
Framework mappings
Post-warning cancel, edit, redirect and proceed behavior provides evidence for evaluating AI/security awareness interventions and identifying improvements. A remediation rate does not prove competence, safe final content or an effective overall program; meaningful denominators and privacy-appropriate collection are needed.
Cancel, edit, redirect and proceed telemetry can inform context-sensitive evaluation of measurements. It complements rather than replaces consultation with end users and domain experts.
Responses to a security warning and the remediation rate provide evidence for evaluating that intervention. Define the denominator and sampling window and use privacy-appropriate collection; a click or edit does not prove safe final content or an effective overall program.
Responses to a security warning and a defined remediation rate evaluate a specific security intervention. The training link applies when the metric evaluates a delivered awareness intervention. Define the objective, denominator, sampling window, responsibility, cadence and evaluation; a click or edit does not prove safe content, competence or understanding of ISMS duties.