Group Purchasing
Group Purchasing
AI SKILLS

LDR521: Security Culture for Leaders

LDR521Cybersecurity Leadership, Artificial Intelligence
  • 5 Days (Instructor-Led)
  • 30 Hours (Self-Paced)
Course authored by:
Lance Spitzner
Lance Spitzner
LDR521: Security Culture for Leaders
Course authored by:
Lance Spitzner
Lance Spitzner
  • 30 CPEs

    Apply your credits to renew your certifications

  • In-Person, Virtual or Self-Paced

    Attend a live, instructor-led class at a location near you or remotely, or train on your time over 4 months

  • Advanced Skill Level

    Course material is geared for cyber security professionals with hands-on experience

  • 22 Hands-On Lab(s)

    Apply what you learn with hands-on exercises and labs

LDR521 turns decades of behavioral science into practical steps you can apply immediately, making security culture measurable, actionable, and sustainable through hands-on labs and tools.

Course Overview

The SANS LDR521: Security Culture for Leaders course empowers cybersecurity leaders with the tools to build, measure, and institutionalize a strong cybersecurity culture across their organization. Through hands-on labs, real-world scenarios, and proven behavioral science frameworks, participants learn how to gain executive buy-in, engage the workforce, and integrate security into everyday business practices. This course is designed for experienced security professionals looking to drive meaningful cultural change and elevate the impact of their security programs.

Security Culture: Building Enterprise-Wide Cybersecurity Buy-in

Security culture is your organization's shared attitudes, perceptions, and beliefs about cybersecurity. The more strongly your leadership and workforce believe in cybersecurity, the more likely they will prioritize security, support your initiatives, and exhibit the behaviors you want. Your organization already has a security culture. The question is, is it the culture you want?

Build and Measure a Strong Security Culture

Drawing on real-world lessons from around the world, the SANS LDR521 Security Culture for Leaders course will teach you how to build a culture where both your leadership and workforce believe in and prioritize cybersecurity. Through hands-on instruction and a series of interactive team labs and exercises, you will apply organizational change concepts to various real-world security initiatives and quickly learn how to transform your security team and embed security into your organization's culture, from senior leadership on down. Apply findings from Daniel Kahneman's Nobel prize-winning research, Thayler and Sunstein's Nudge Theory, ADKAR change model and Simon Sinek's Golden Circle. Learn how Spock, Homer Simpson, the Elephant and Rider, and the Curse of Knowledge are all keys to building a strong security culture at your organization.

This course is based on the foundation of applying what you learn. Throughout the class are 22 interactive team labs and case studies, similar to many of today’s top business schools. Leveraging the Cyber42 simulation game environment, you are put in real-world scenarios that spur discussion and critical thinking of situations you will encounter at work as you compete for the LDR521 Challenge coin. A Laptop with access to the internet is required for the Cyber 42 leadership simulation capstone and many of the hands-on labs.

Syllabus Summary

  • Section 1: Learn the fundamentals of and decipher your organizational and security culture.
  • Section 2: Define what you want your security culture to be and your strategy to achieve it.
  • Section 3: Operationalize your strategy with key initiatives to motivate your workforce.
  • Section 4: Operationalize your strategy with key initiatives to enable your workforce.
  • Section 5: Learn how to quantify your security culture and final steps to actioning it

Notice to Students

The course is recommended for more senior and/or more experienced cybersecurity leaders, managers, officers, and awareness professionals. If you are new to cybersecurity, we recommend some of SANS's more fundamental courses, such as SEC301: Introduction to Cyber Security, SEC401: Security Essentials: Network, Endpoint, and Cloud, or LDR433: Human Risk Management.

Author Statement

"For far too long, security teams have struggled with the human side of cybersecurity. Security culture is not nearly as hard as many believe; instead of fighting human nature, this course is all about aligning with human nature. LDR521 arms you with the knowledge, skills, and resources to institutionalize a strong security culture so your organization believes in and prioritizes cybersecurity. In addition, the course will provide you the resources to measure and communicate the impact to members of your leadership, ensuring their long-term support."

- Lance Spitzner

What You'll Learn

  • Define, map and measure both organizational and security culture
  • Build a practical strategy leveraging the four key drivers of your security culture
  • Communicate the business value of security to gain executive buy-in
  • Engage and motivate your workforce to prioritize and adopt secure behaviors
  • Architect and embed security so it aligns with how people think and operate
  • Improve the success of security initiatives with actionable strategies and tools

Business Takeaways

  • Build a strong, positive brand for you and your security team, be perceived as enablers
  • Embed security at the start of all business initiatives
  • Increase buy-in and success rates of all security programs
  • Gain critical executive leadership support, speak in their language
  • Create a workforce that naturally prioritizes security
  • Reduce security team burnout through cultural alignment

Course Syllabus

Explore the course syllabus below to view the full range of topics covered in LDR521: Security Culture for Leaders.

Section 1Fundamentals of Organizational and Security Culture

Learn the fundamentals of culture and how to decipher your organizational and security culture.

Topics covered

  • Role of strategy vs. culture
  • Defining and mapping organizational culture
  • Role of AI in changing culture
  • Defining and indicators of security culture
  • Security culture assessment

Labs

  • Cyber42 Challenge #1: Mapping Linden Insurance’s Culture
  • Lab 1.1 Map your organization's culture
  • Cyber42 Challenge #2: Rating Linden Insurance’s Security Culture
  • Lab 1.2 Survey your security culture

The Decipher section of LDR521 is where students begin their journey by learning how to analyze and understand both their organization’s overall culture and security culture. You will be introduced to powerful frameworks such as the Competing Values Framework (CVF) and the Culture Iceberg model, which make it easier to map, define, and measure the cultural forces shaping security behaviors. Through case studies, team labs, and online simulations, you will practice identifying cultural strengths, weaknesses, and subcultures across departments, regions, and leadership levels. By the end of this section, you will have the tools to uncover what your workforce truly thinks and feels about security, setting the foundation for a strategy that can transform security from being seen as a blocker into being embraced as a trusted enabler.

Section 2Defining Your Strategy

Define what you want your security culture to be and develop an actionable strategy on how to achieve it.

Topics covered

  • Building your strategy to culture change
  • Proven organizational change models and frameworks
  • Motivating and Enabling change
  • Four drivers to your security culture
  • Developing your security principles and guidelines

Labs

  • Cyber42 Challenge #3: Preparing for a Breach
  • Cyber42 Challenge #4: Announcing Security
  • Lab 2.1: Define your Desired Security Culture
  • Cyber42 Challenge #5: Security Team Engagement
  • Lab 2.2: Define Your Security Guidelines

The Define section of LDR521 helps security leaders move from simply understanding culture to actively shaping it with intention. In this module, students learn how to define the desired security culture for their organization and create a strategy to close the gap between current reality and future goals. You will explore proven organizational change models (such as Kotter’s 8 Steps, ADKAR, and Satir), but also learn how to adapt and simplify them for real-world security initiatives. Students will gain hands-on practice mapping culture drivers, creating strategic security guidelines, and performing gap analyses. The benefit is clear: you will leave this section with a practical, actionable roadmap for embedding security into your organization’s daily operations, enabling you to drive cultural change that sticks with both your workforce and leadership.

Section 3Motivating Change

Discover how to effectively engage and motivate your workforce to prioritize cybersecurity. Learn marketing models, persona development, and incentive programs that drive behavioral change across the organization.

Topics covered

  • Safety and motivation principles
  • Leveraging marketing models and frameworks
  • Creating engagement personas
  • Incentivizing security behaviors

Labs

  • Lab 3.1 Persona for Software Developers
  • Cyber42 Challenge #6: Getting to Know Accounts Payable
  • Lab 3.2 Selling DevSecOps
  • Lab 3.3 Creating a Custom GPT
  • Cyber42 Challenge #7: Incentivization Program

The Motivate section of LDR521 equips security leaders with the skills to win buy-in and drive lasting behavior change by tapping into the psychology of motivation. Rather than relying on mandates and fear, you will learn how to engage people by answering the all-important question, “What’s in it for me?” (WIIFM) and framing security initiatives in ways that resonate emotionally as well as logically. Through tools like Simon Sinek’s Golden Circle, the AIDA marketing model, and the use of personas, you will practice communicating security in language your workforce, executives, and board members actually understand and care about. The benefit to you is clear: you will leave with the ability to transform security from something people resist into something they embrace, making your initiatives far more effective and positioning your security team as approachable, helpful partners rather than feared enforcers and blockers.

Section 4Enabling Change

Learn how to overcome the "Curse of Knowledge" and make security simple for your entire workforce. Master proven models so your security initiatives and priorities align with and become embedded in people’s daily processes and activities.

Topics covered

  • Architecting security so it aligns with people’s daily activities
  • Address cognitive biases effectively
  • Building security knowledge
  • Simplifying and embedding security processes

Labs

  • Lab 4.1: Passkeys email
  • Cyber42 Challenge #8: Engaging Training
  • Lab 4.2: Enabling a Human Sensor Network
  • Cybe42 Challenge #9: AI Security Policy

The Enable section of LDR521 enables students to remove barriers and make secure behaviors simple, intuitive, and sustainable for their workforce. You will learn how to overcome cognitive biases such as the “Curse of Knowledge,” apply Adult Learning Theory, and leverage behavioral economics to design environments where the secure choice is the easy choice. The course covers practical approaches to simplifying policies, architecting workflows, and creating positive security experiences so employees feel supported rather than burdened. Students also gain hands-on practice crafting clear communications, building role-relevant training, and designing “nudges” that align with human nature. The benefit is that you will walk away with strategies to empower your workforce to succeed at security without resistance, dramatically increasing adoption and reducing risk while strengthening your credibility as a leader.

Section 5Measuring Change and Final Steps

Learn how to quantify your security culture and how the changes you are making support leadership’s strategic priorities. Sell your security initiatives and priorities in business terms that resonate with leadership.

Topics covered

  • Design effective security culture surveys
  • Analyze and quantify metrics for action items
  • Align metrics with leadership’s priorities
  • Build strong business cases
  • Create executive-ready summaries

Labs

  • Lab 5.1 Create Survey Questions
  • Lab 5.2 Analyze Open Ended Questions
  • Lab 5.3 Create an Executive Summary for Linden Insurance

The Measure section of LDR521 teaches cybersecurity leaders how to quantify, track, and improve the impact of their security culture initiatives. You will learn how to design and analyze surveys, focus groups, interviews, and help desk feedback to uncover what your workforce really thinks and feels about security. The course also introduces metrics frameworks—covering behaviors, knowledge, culture, and strategic impact—so you can link cultural progress directly to reduced risk and organizational priorities. Students gain practical experience building business cases and executive summaries that translate technical outcomes into business value. The benefit is that you will leave with the ability to prove the effectiveness of your culture program, communicate in business terms and earn leadership credibility, and secure ongoing investment by showing measurable, strategic results.

Things You Need To Know

A laptop or mobile device with the latest web browser is required to play the Cyber42 leadership simulation game and do several of the online AI labs.

The Cyber42 game used in this course is hosted in the cloud. Students must have a computer that does not restrict access to the ranges.io website. In addition, for several of the AI labs students must have access to the chatgpt.com website. Corporate machines may have a VPN, intercepting proxy, or egress firewall filter that causes connection issues when communicating with certain websites. Students must be able to configure or disable these services to access the Cyber42 game.

If you have additional questions about the laptop requirements, please contact customer service.

LDR521 training is recommended for a diverse range of individuals, including:

  • Chief Information Security Officers
  • Chief Risk Officers/Risk Management Leaders
  • Security Awareness, Engagement or Culture Managers
  • Senior Security Managers Who Lead Large-scale Security Initiatives
  • Information Security Managers, Officers, and Directors
  • Information Security Architects and Consultants
  • Aspiring Information Security Leaders
  • Business Continuity/Disaster Recover Leaders
  • Privacy/Ethics Officers

  • Printed Course Books
  • Digital Download Package: A collection of templates, checklists, matrices, reports, and other resources that will help you in building a strong security culture and your security career. This package is continually updated and based on resources that real security leaders have used to develop and grow their own security cultures. Why reinvent the wheel when you can reuse or reshape what has worked for others!
  • Community Forum: An opportunity to join the private, invitation-only Community Forum dedicated to the human side of security. The forum currently has over 2,000 active professionals from around the world!

This course fits within SANS's leadership development track, complementing LDR512: Security Leadership Essentials and LDR514: Strategic Planning, Policy and Leadership. Together, these courses form the Transformational Cybersecurity Leadership Triad. For professionals newer to security, recommended starting points include SEC301: Introduction to Cybersecurity, SEC401: Security Essentials, or LDR433: Human Risk Management.

LDR521 is part of the SANS Transformational Cybersecurity Leadership Triad, which includes LDR512 and LDR514. This comprehensive path develops well-rounded security leaders capable of building effective programs.

Security culture refers to your organization's shared attitudes, perceptions, and beliefs about cybersecurity. It determines how seriously your workforce and leadership prioritize security and whether they naturally incorporate security practices into daily operations and goals. Every organization has a security culture—the question is do you have the security culture you need?

As a security leader, this course provides you with practical frameworks to scale your impact beyond technical solutions. You'll develop strategic skills to influence executives, engage employees, and drive organizational change—positioning yourself as a business-focused security leader and create a culture of cybersecurity. These leadership capabilities are increasingly critical for senior security roles in global enterprises and will enhance your value as a strategic cybersecurity executive.

Relevant Job Roles

Cybersecurity Curriculum Development (OPM 711)

NICE: Oversight and Governance

Responsible for developing, planning, coordinating, and evaluating cybersecurity awareness, training, or education content, methods, and techniques based on instructional needs and requirements.

Explore learning path

Secure Project Management (OPM 802)

NICE: Oversight and Governance

Responsible for overseeing and directly managing technology projects. Ensures cybersecurity is built into projects to protect the organization’s critical infrastructure and assets, reduce risk, and meet organizational goals. Tracks and communicates project status and demonstrates project value to the organization.

Explore learning path

Systems Security Management (OPM 722)

NICE: Oversight and Governance

Responsible for managing the cybersecurity of a program, organization, system, or enclave.

Explore learning path

Senior Security Leader

Cybersecurity Leadership

Daily focus is on the oversight of technical teams while aligning them to overall business strategies. Includes titles such as Technical Director, Information Security Officer, and CISO.

Explore learning path

Cybersecurity Instruction (OPM 712)

NICE: Oversight and Governance

Responsible for developing and conducting cybersecurity awareness, training, or education.

Explore learning path

Transformational Cybersecurity Leader

Cybersecurity Leadership

Align technology, business strategy, and people.

Explore learning path

Leadership

SCyWF: Leadership And Workforce Development

This role conducts supervises, manages and leads cybersecurity teams and work. Find the SANS courses that map to the Leadership SCyWF Work Role.

Explore learning path

Workforce Development

SCyWF: Leadership And Workforce Development

This role conducts leads cybersecurity teams and work. Develops cybersecurity human capital. Find the SANS courses that map to the Workforce Development SCyWF Work Role.

Explore learning path

Course Schedule and Pricing

Have Questions?Contact Us
  • Location & instructor

    Virtual (OnDemand)

    Instructed by
    Date & Time
    OnDemand (Anytime)Self-Paced, 4 months access
    Course price
    $8,260 USD*Prices exclude applicable local taxes
    Registration Options
  • Location & instructor

    SANS Virginia Beach 2026

    Virginia Beach, VA, US & Virtual (live)

    Instructed by
    Date & Time
    Fetching schedule..
    Course price
    $8,260 USD*Prices exclude applicable local taxes
    Registration Options
  • Location & instructor

    SANS London October 2026

    London, GB

    Instructed by
    Date & Time
    Fetching schedule..
    Course price
    £6,715 GBP*Prices exclude applicable taxes | EUR price available during checkout
    Registration Options
  • Location & instructor

    SANS Live Online Europe October 2026

    Virtual (live)

    Instructed by
    Date & Time
    Fetching schedule..
    Course price
    €7,715 EUR*Prices exclude applicable local taxes
    Registration Options
  • Location & instructor

    SANS Miami 2026

    Virtual (live)

    Instructed by
    Date & Time
    Fetching schedule..
    Course price
    $8,260 USD*Prices exclude applicable local taxes
    Registration Options
  • Location & instructor

    SANS Nashville 2027

    Nashville, TN, US & Virtual (live)

    Date & Time
    Fetching schedule..
    Course price
    $8,260 USD*Prices exclude applicable local taxes
    Registration Options
Showing 6 of 6

Benefits of Learning with SANS

Bryan Simon: Teacher Standing Next to Smartboard and Explaining Concept

Get feedback from the world’s best cybersecurity experts and instructors

OnDemand Mobile App

Choose how you want to learn - online, on demand, or at our live in-person training events

Close Up of Woman Holding a Pen and Documents

Get access to our range of industry-leading courses and resources