SANS Security Awareness, the global leader in providing security awareness training, and a division of SANS Institute, announced they have released the 2019 Security Awareness Report. In its fifth consecutive year, this annual report entitled “The Rising Era of Awareness Training” builds on findings from previous years and zeroes in on the primary issues faced by security awareness professionals: a lack of resources, leadership support, and job role ambiguity.
“I’m absolutely thrilled about the release of the 2019 Security Awareness report,” says SANS Security Awareness Director, Lance Spitzner. “Every year we are able to gain a better understanding of the most common challenges awareness professionals face and how to best address them and after five years, we are beginning to identify key trends.”
The intention of the SANS Security Awareness Report is to provide security awareness professionals with a roadmap to make data-driven decisions on how to improve their security awareness programs. It also provides professionals with the ability to benchmark their programs against their industry peers. Essentially, it works to more definitively answer the question of what ingredients go into making a security awareness program successful. This year, data was analyzed from nearly 1,600 respondents providing even greater insight into how to benchmark and mature a security awareness program.
Working with researchers from The Kogod Cybersecurity Governance Center (KCGC), an initiative of American University’s Kogod School of Business (KSB), the survey data was examined in detail to provide information on:
- Common challenges holding back program maturity – lack of time and staffing were among the top reported roadblocks facing awareness professionals.
- Achieving leadership support and program buy-in – industry peer pressure was found to have a distinctive role in determining whether leadership treats security awareness training as a top priority.
- The growing need to create more concrete job roles and expectations within the security awareness training realm – less than 10% of the respondents reported their job titles even included the words ‘awareness’ or ‘training’ in them.
This report highlights these growing concerns and challenges for security awareness. It also utilizes the SANS Security Awareness Maturity Model as a guide to identify an organization’s level of a program’s impact and how to measure human risk and change end-user behavior. This model, which has been revamped in this year’s report, provides organizations with the ability to easily identify where their security awareness program is currently at, where a qualified leader can take it, and it even outlines the path to get them to where they want to be.
For more detailed analysis and recommended action on improving an awareness strategy, the 2019 SANS Security Awareness Report is available for download here.