You have been producing reports for six months and you suspect nobody is reading them. How do you find out, and what do you change?

I would treat this as a requirements failure rather than a distribution problem, because "nobody reads it" almost always means "it does not answer a question anyone had".

First I would go and ask, in person, and ask the right question. Not "are our reports useful", which everyone answers politely, but "what did you do differently because of anything we sent you in the last quarter". If the answer is nothing, that is the finding. I would also ask what they wish they knew and cannot find out, which usually surfaces the real requirement.

Then I would look at four specific failure modes.

Altitude: am I sending tactical detail to someone who needed a risk judgement, or a strategic overview to engineers who needed a query? This is the most common mismatch.

Timing: is it arriving after the decision was made? A monthly report cadence chosen for the producer's convenience will consistently miss the consumer's decision points.

Format: is the judgement in the first paragraph, or is it on page three after the background and methodology? If a reader has to hunt for the "so what", they stop reading. And is it too long for the audience — a board member is not going to read six pages.

Relevance: is it scoped to this organisation, or is it a threat landscape summary they could get from a news feed?

Then I would change something structural rather than tinkering. Cut the products nobody named, which is uncomfortable but correct — producing an unread report every month is worse than producing nothing, because it consumes analyst time and creates the appearance of a function. Re-establish requirements with named stakeholders and named decisions. Match cadence to their decision cycles rather than ours. And agree what "answered" looks like so requirements can retire.

For measurement I would drop report volume entirely and track decisions influenced, requirements satisfied and retired, detections built from our work and their true-positive rate, and time from external disclosure to internal exposure assessment. Those are checkable and they are what justifies the team.