Metrics for Social Engineering Controls

Anyone have any thoughts on which metrics might be best for controls for social engineering?

Most seem to use something like adherence to security awareness training as a key performance indicator (KPI). This is fine as one barometer. But it's far from ideal since there are both difference qualities of training and different people's attention and adherence to following it afterwards.

I also dislike email phishing tests, such as those most everyone seems to use thru KnowBe4 (I like this …

controls cybersecurity engineering metrics social social engineering