Learn Actionable Steps to Mature Your Security Awareness Programs and Compare Your Program Against Global Benchmarks
Bethesda, MD, June 29, 2022 - With an unprecedented number of employees now working in hybrid or fully remote environments, compounded by an increase in cyber threats and a more overwhelmed, COVID-19 information fatigued workforce, there has never been a more critical time to effectively create and maintain a cyber-secure workforce and an engaged security culture.
“People have become the primary attack vector for cyber-attackers around the world,” said Lance Spitzner, SANS Security Awareness Director and co-author of the report. “Humans rather than technology represent the greatest risk to organizations and the professionals who oversee security awareness programs are the key to effectively managing that risk.”
After analyzing the data of more than 1,000 security awareness professionals worldwide, SANS Security Awareness, the global leader in providing security awareness training, has released its seventh annual SANS Security Awareness Report. The 2022 report establishes updated global benchmarks for how organizations manage their human risk and provides actionable steps to making improvements with key metrics in the Security Awareness Maturity Model Indicators Matrix to measure progress.
“Awareness programs enable security teams to effectively manage their human risk by changing how people think about cybersecurity and help them exhibit secure behaviors, from the Board of Directors on down,” said Spitzner. “This report enables security awareness professionals to make data-driven decisions on how to best secure their workforce and speak to leadership about risk in a compelling way that demonstrates value and support for their strategic priorities.”
Key Findings:
- Workforce: More than 69% of security awareness professionals are spending less than half their time on security awareness. The data shows that security awareness responsibilities are very commonly assigned to staff with highly technical backgrounds who may lack the skills needed to effectively engage their workforce in simple-to-understand terms.
- US Compensation: The average salary reported was $110,309 USD for security training professionals, an increase from 2021. However, those dedicated full-time to awareness were paid on average only $86,626, while those who are part-time averaged $117,584 – $30,000 difference. This difference is because people dedicated part-time to security awareness have their compensation based on their other responsibilities, which are usually more technically focused.
- Global Compensation: Security awareness professionals in Australia/New Zealand had the highest average annual compensation ($121,236), while South America had the lowest ($56,960). In North America, the higher the maturity level of an organization’s security awareness program, the higher the salary for the awareness professionals who work there.
- Top Reported Challenges: The three top reported challenges for building a mature awareness program were all related to a lack of time: specifically Lack of time for project management, limits on training time to engage employees, and a lack of staffing.
- Pandemic Impacts: The top two reported impacts were the challenge of a more distracted and overwhelmed workforce and a working environment where human-based cyber-attacks have become more frequent and effective.
- Program Maturity by Region: Consistent across all global regions is that current programs' most common maturity levels are compliance-focused and awareness/behavior change.
- Successful Program Indicators: Strong leadership support, increased team size, and a higher training frequency topped the charts as key enablers to program success.
Key Action Items to Increase Program Success:
- Action Items to Increase Leadership Support: One of the top ways to increase leadership support is speaking in terms of managing risk, not compliance, and explaining WHY you are doing something, not WHAT you are doing. Additionally, creating a sense of urgency by utilizing data and communicating value by demonstrating alignment with leadership’s priorities.
- Action Items to Increase Team Size: Documenting and contrasting how many people on the security team are focused on technology versus how many on the team are focused on human risk, creating a document to explain personnel needs fully, and developing partnerships with key departments that can help develop ways to communicate the program's value were recommended.
- Action Items to Increase Training Frequency: It is recommended that organizations communicate to, interact with, or train their workforce at least once a month. Keeping training simple and easy to follow was the key to increasing your opportunities to engage and train your workforce.
“The most mature security awareness programs not only change their workforce’s behavior and culture but also measure and demonstrate their value to leadership via a metrics framework,” continued Spitzner. “Organizations can no longer justify an annual training to check the compliance box, and it remains critical for organizations to dedicate enough personnel, resources, and tools to manage their human risk effectively.”
For a more detailed analysis, download the 2022 SANS Security Awareness Report is available for download here.
About SANS Institute
The SANS Institute was established in 1989 as a cooperative research and education organization. Today, SANS is the most trusted and, by far, the largest provider of cybersecurity training and certification to professionals in government and commercial institutions world-wide. Renowned SANS instructors teach more than 60 courses at in-person and virtual cybersecurity events and on demand. GIAC, an affiliate of the SANS Institute, validates practitioner skills through more than 35 hands-on, technical certifications in cybersecurity. The SANS Technology Institute, a regionally accredited independent subsidiary, offers master’s and bachelor’s degrees, graduate certificates, and an undergraduate certificate in cybersecurity. SANS Security Awareness, a division of SANS, provides organizations with a complete and comprehensive security awareness solution, enabling them to manage their “human” cybersecurity risk easily and effectively. SANS also delivers a wide variety of free resources to the InfoSec community including consensus projects, research reports, webcasts, podcasts, and newsletters; it also operates the Internet's early warning system–the Internet Storm Center. At the heart of SANS are the many security practitioners, representing varied global organizations from corporations to universities, working together to support and educate the global information security community. www.sans.org