Training
Featured Course View All Courses
Get a Free Hour of SANS Training

Experience SANS training through course previews.

Learn More
Learning Paths
FeaturedView all Focus Areas
NEW - AI Security Training
Can't find what you are looking for?

Let us help.

Contact us
Free Resources

SANS Community Benefits

Connect, learn, and share with other cybersecurity professionals

Customer Case Studies

Discover how organizations and individual cyber practitioners use SANS training and GIAC certifications

AI Risk & Readiness

Explore expert-driven guidance, training, and tools to help defend against AI-powered threats and adopt AI securely

Join the SANS Community

Become a member for instant access to our free resources.

Sign Up
For Organizations

Public Sector

Mission-focused cybersecurity training for government, defense, and education

Partnerships

Explore industry-specific programming and customized training solutions

Sponsorship Opportunities

Sponsor a SANS event or research paper

Interested in developing a training plan to fit your organization’s needs?

We're here to help.

Contact Us
Group Purchasing
Group Purchasing

SANS Security Awareness Professional Certification (SSAP)

Security Awareness Certification Overview

The SSAP certifies that the holder can manage and measure human risk and has met the requirements to elevate the security behavior of a workforce.

Explore LDR433 CourseRegister for the Exam
Jump to:

What Is the SSAP Certification?

Organizations need proven leaders who can manage and measure human risk. The SANS Security Awareness Professional (SSAP) certifies that the holder has met the requirements to build, maintain, and elevate the security behavior of a workforce, from gaining leadership support through measuring program impact.

By the numbers

2 hrs

Exam duration

50

Questions

78%

Min. passing score

What SSAP Covers

The six areas covered in the SSAP group into three practical domains, matched to LDR433's three sections.

Program Maturity & Leadership Support

Benchmarking your program against the five stages of the Security Awareness Maturity Model and gaining and maintaining leadership advocacy.

Changing Behavior Through Training

Identifying and documenting target groups, deploying relevant training, engaging across culture, role, generational, nationality, and language lines, and applying learning theory and behavior change models.

Culture, Sustainment & Measurement

Cultural analysis, sustaining the program through approaches like ambassador programs, and measuring impact to track human risk reduction and communicate value to leadership.

Prepare With This Course

LDR433: Managing Human Risk

Course Details

How LDR433 Prepares You for SSAP

LDR433 is built around the areas that make up the SSAP certification:

  • Section 1, Fundamentals and Identifying/Prioritizing Human Risk builds skills tested under benchmarking your program against the five stages of the Security Awareness Maturity Model and gaining leadership advocacy for your program.
  • Section 2, Identifying and Changing Behavior builds skills tested under identifying and documenting target groups, deploying relevant training, and applying key models for learning theory and behavioral change.
  • Section 3, Security Culture and Measuring Change builds skills tested under engaging and communicating across culture, role, generational, and language lines, sustaining your program through approaches such as ambassador programs, and measuring impact to communicate the program's value to leadership.

Across all three sections, six hands-on team labs and a final action-planning exercise give you the chance to apply each skill before you sit the exam.

Read the full SSAP certification overview

LDR433 Course Author

Lance Spitzner
Lance Spitzner

Lance Spitzner

Director, Workforce Cybersecurity Training at SANS Institute

Lance revolutionized cyber defense by founding the Honeynet Project. At SANS, he has empowered over 350 organizations worldwide to build resilient security cultures, transforming human risk management into a cornerstone of modern cybersecurity.

Read more about Lance Spitzner

Who Should Pursue SSAP

Security Awareness & Training Officers

CISOs & Security Leaders

Governance, Compliance & Audit Staff

Security Ambassador and Champion Program Owners

Corporate Communications Staff

Culture and Organizational Change Specialists

Frequently Asked Questions

The SSAP certifies that you can manage and measure human risk and have met the requirements to elevate the security behavior of a workforce. That covers benchmarking a program's maturity, gaining leadership support, changing behavior through training and engagement, and measuring the program's impact.

The exam has 50 questions, a two-hour time limit, and a 78% passing score. It follows GIAC's exam process. That means GIAC's open-book policy applies, and you take the exam proctored at a Pearson VUE testing center or online. Attempts are valid for four months (120 days) from activation.

The SSAP is valid for four years. To renew, attend any SANS Summit after earning the SSAP and before it expires. Then complete the renewal from your SANS portal account and pay the renewal fee within the two-year window before your credential expires.

The SSAP fits security awareness and training officers, CISOs and security leaders, governance and compliance staff, and people who run ambassador or champion programs. It also fits corporate communications staff and culture and change specialists who own part of an organization's awareness work.

LDR433: Managing Human Risk, authored by Lance Spitzner, maps directly to the areas the SSAP covers. It is a three-day course with six hands-on team labs, available in person, live virtual, or self-paced. Bundling the SSAP attempt with LDR433 includes one practice test. Exam attempts bought without training do not include one. 

Ready to earn your SSAP certification?

Add the SSAP exam attempt when you register for LDR433.

Register for LDR433

Already trained? Register for the exam through the LDR433 course page here.