Phishing simulations measure only part of human risk. How to enrich the per-person score with real signals from your SIEM and security stack.