Organizations Making Little Headway in Addressing Human Risk

Most enterprise security awareness efforts remain half-hearted, a new SANS survey shows.

Though human errors — such as falling for phishing scams that result in data compromise or credential theft — remain one of the top security risks for organizations today, few appear to be making much progress in addressing the problem.
The sixth and latest edition of the SANS Institutes annual security awareness report, released Tuesday, shows that enterprise initiatives for minimizing human risk continue to be little more than a part-time effort at many organizations.
The survey of over 1,500 professionals involved in security awareness training found 75% spend less than half their time on that task. When responsibility for the function was assigned, it went commonly to staff with overly technical backgrounds and not enough skills for engaging the workforce in easy-to-understand terms.
Overall, the data is trending the same as in previous years, says Lance Spitzner, SANS security awareness director and co-author of the report. Awareness continues to be a part-time effort, which is why so many organizations are struggling to effectively secure employee behavior and ultimately manage human risk.
A lack of time and personnel continue to pose big challenges for organizations seeking to build a mature security awareness program,
the survey found
. Organizations that had made progress in changing employee behaviors with their awareness programs had at least 2.5 full-time equivalent employees dedicated to the mission. Organizations with the most mature awareness programs had at least 3.5 full-time employees.
However, SANS found the percentage of organizations that actually reported having staff of any size dedicated full time to the security awareness function was low.
Roughly 10% of organizations out there — represented by our respondents — have someone dedicated full time to security awareness, Spitzner says. That is similar to what we have seen over the past surveys, [so] no real change there.
In most other cases, when an organization has someone working in security awareness, that person is in IT or security and already has numerous other responsibilities, he notes. The SANS survey found salaries, on average, were higher for individuals in other roles handling security awareness on a part-time basis ($106,00) than for individuals dedicated to the role on a full-time basis ($96,000).
As in past surveys, SANS polled respondents on their backgrounds and roles prior to working in security awareness: More than 800 of the 1,500 surveyed professionals had backgrounds in information security or information technology before they began work in security awareness. Less than 20% had a nontechnical background, such as marketing, communications, legal, and human resources.
The problem with having people with overly technical backgrounds performing training is they can have a harder time communicating and teaching security fundamentals to nontechnical people. Though a certain level of technical expertise is essential for working in security awareness, experts in the field can often perceive security as being easy to understand simply because it is part of their daily life, SANS observed in its report.
Human risk is a people problem, so it takes a human solution to address it, says Spitzner.
However, that does not mean completely nontechnical soft skills alone are enough for a security awareness role.
The awareness professional should be an extension of the security team, Spitzner notes. This means they should have a basic understanding of cybersecurity, the models and frameworks involved, and perhaps a basic understanding of the technology and attackers involved.
They would also need to have a passion for learning and helping and have strong skills in communicating and partnering with others, he says.
The Right Focus
SANS said organizations should ensure that any person they put in charge of the security awareness function has a title that emphasizes the human risk aspect of the role — for example, human risk officer. Often, organizational leaders have a tendency to discuss the role in the context of awareness, training, engagement, or influence.
But those terms focus on whats being done rather than why it needs to be done, Spitzner says. Managing human risk is a better fit, he says, because it aligns with leaderships strategic security priorities and explains why awareness needs to be an extension of the security team.
SANS found that security awareness programs typically garner the strongest support from the information security and IT teams, as well as human resources, audit, and senior leadership. Conversely, the biggest opposition to these efforts typically existed within operational teams and the finance group — likely because these are two areas affected most by security awareness programs.
To address concerns from the finance group, SANS recommends security leaders focus on the value of security awareness programs. One way to do that would be to consider the cost of past breaches or compliance failures and compare it to the cost of the security awareness program. Similarly, to address the concerns of operational groups, the security awareness group should focus on ways to reduce lost work hours due to training — by, for example, reducing the number of topics to focus upon.
Awareness is nothing more than another security control, one designed to manage human risk, Spitzner says. Security teams need to be treating it as such.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Organizations Making Little Headway in Addressing Human Risk