Case Study: Galicia builds regional cyber resilience through public SANS training programme

The regional government of Galicia, Spain, is strengthening its cyber resilience through a strategic public cybersecurity training programme delivered with the Centro de Novas Tecnoloxías de Galicia (CNTG) and SANS Institute. Launched in 2024, at a time when Spain ranked fifth globally for ransomware attacks, the initiative provides SANS training to citizens across the region, including both employed and unemployed participants.

"This is training that other entities should invest in because it establishes a differential element for their citizens or professionals. For us, it is a safe bet, a safe investment."

Identifying Cybersecurity Skills Gaps

The programme began with a comprehensive needs assessment led by Amtega, Galicia’s Agency for Technological Modernisation. In collaboration with public- and private-sector stakeholders, Amtega identified the most critical cybersecurity skills gaps across the regional workforce. Through Spain’s public procurement process, SANS Institute was selected as the training provider thanks to its global reputation and the value of its industry-recognised GIAC certifications.

Measurable Impact in 2024

In the first 2024 cohort, 20 students completed SEC504 and FOR508 courses, achieving satisfaction scores above 9/10 and reporting tangible career advancement, including salary increases. Local companies also benefited, as newly certified employees helped them qualify for tenders requiring certified cybersecurity professionals.

A Sustainable Model for Cyber Resilience

The programme’s early success has established a sustainable model in which public investment in cybersecurity education delivers measurable returns across the regional economy. Plans are already underway to expand the curriculum with SEC556 and FOR572, further strengthening local capabilities in areas such as incident response and digital forensics.

A Replicable Blueprint for Governments

Galicia’s collaborative approach shows how regional governments can address immediate cybersecurity skills shortages while building long-term cyber resilience. This initiative offers a replicable blueprint for other autonomous regions and governments worldwide seeking to enhance their cybersecurity posture through accessible, high-quality training.

Click here to read the entire Case Study