The most common factors holding back security awareness programmes in companies are the lack of time and staff rather than budget, although nearly 60% of the professionals surveyed say they are not even aware of the budget allocated to security awareness in their companies.<\/p>\n
These are some of the key findings of the 2019 Security Awareness Report<\/em>, the fifth edition of a report produced annually by SANS Security Awareness, a division of SANS Institute and a world leader in security training.<\/p>\n The study compares current data with that of previous years and analyses the main problems faced by security awareness professionals in companies: lack of resources, managerial support and ambiguity in their positions and responsibilities.<\/p>\n The intention of the SANS Security Awareness Report is to provide security awareness professionals with a road-map to make data-driven decisions on how to improve their security awareness programmes. It also provides professionals with the ability to benchmark their programmes against their industry peers.<\/p>\n Essentially, it works to more definitively answer the question of what ingredients go into making a security awareness programme successful. This year, data was analysed from nearly 1,600 respondents providing even greater insight into how to benchmark and mature a security awareness programme.<\/p>\n \u201cI\u2019m absolutely thrilled about the release of the 2019 Security Awareness Report<\/em>,\u201d says SANS Security Awareness Director, Lance Spitzner. \u201cEvery year we are able to gain a better understanding of the most common challenges awareness professionals face and how to best address them and after five years, we are beginning to identify key trends.\u201d<\/p>\n Working with researchers from\u00a0The Kogod Cybersecurity Governance Center (KCGC), an initiative of American University’s Kogod School of Business (KSB), the survey data was examined in detail to provide information on:<\/p>\n This report highlights these growing concerns and challenges for security awareness. It also utilises the SANS Security Awareness Maturity Model as a guide to identify an organisation’s level of a program’s impact and how to measure human risk and change end-user behaviour.<\/p>\n This model, which has been revamped in this year\u2019s report, provides organisations with the ability to easily identify where their security awareness programme is currently at, where a qualified leader can take it and it even outlines the path to get them to where they want to be.<\/p>\n\n