SANS recently released tools for measuring security awareness behavior changes. Assuming a security-awareness training program is ongoing, how often should behavior be assessed, and how do we establish realistic goals?