Cohort retention is a measurement method that groups users by a shared start event and checks whether they keep returning over time. In practice, the start event might be first login, first alert review, first policy enrollment, or first use of a security tool. Instead of asking only how many people tried something once, retention asks how many still use it after days or weeks.
In cyber security, this matters because many controls fail quietly after launch. A phishing-training platform, MFA rollout, SIEM dashboard, or EDR console may show strong initial adoption but weak repeat use. Cohort retention exposes that drop-off and helps defenders distinguish a successful rollout from a one-time click. For attackers, low retention can also be a signal that users do not trust a tool, do not understand it, or find it too hard to use. Security teams use retention curves to spot onboarding problems, workflow friction, and tools that never became part of daily operations.