Training
Featured Course View All Courses
Get a Free Hour of SANS Training

Experience SANS training through course previews.

Learn More
Learning Paths
FeaturedView all Focus Areas
NEW - AI Security Training
Can't find what you are looking for?

Let us help.

Contact us
Free Resources

SANS Community Benefits

Connect, learn, and share with other cybersecurity professionals

Customer Case Studies

Discover how organizations and individual cyber practitioners use SANS training and GIAC certifications

AI Risk & Readiness

Explore expert-driven guidance, training, and tools to help defend against AI-powered threats and adopt AI securely

Join the SANS Community

Become a member for instant access to our free resources.

Sign Up
For Organizations

Public Sector

Mission-focused cybersecurity training for government, defense, and education

Partnerships

Explore industry-specific programming and customized training solutions

Sponsorship Opportunities

Sponsor a SANS event or research paper

Interested in developing a training plan to fit your organization’s needs?

We're here to help.

Contact Us
Group Purchasing
Group Purchasing
AI SKILLS

LDR433: Managing Human Risk

LDR433Cybersecurity Leadership, Artificial Intelligence
  • 3 Days (Instructor-Led)
  • 18 Hours (Self-Paced)
Course authored by:
Lance Spitzner
Lance Spitzner
Register NowCourse Preview
LDR433: Managing Human Risk
Course authored by:
Lance Spitzner
Lance Spitzner
Register NowCourse Preview
  • SANS Security Awareness Professional (SSAP)

    Learn about certification

  • 18 CPEs

    Apply your credits to renew your certifications

  • In-Person, Virtual or Self-Paced

    Attend a live, instructor-led class at a location near you or remotely, or train on your time over 4 months

  • Intermediate Skill Level

    Course material is geared for cyber security professionals with hands-on experience

  • 6 Hands-On Lab(s)

    Apply what you learn with hands-on exercises and labs

Jump to:

This course enables you to build a mature awareness program, providing you with the roadmap, skills, and resources to drive behavior change and effectively manage and measure your organization’s human risk in today’s AI world.

Featured Quote

I think the course is really engaging and works at two levels: 1. Provides someone starting out with a solid foundational knowledge 2. Allows an existing program to benchmark and get new ideas, to supplement the existing work.
Brian WrightStudent Loans Company Unlimited

Course Overview

LDR433 provides students with a structured, customized roadmap to build, manage, and measure their organization’s human risk. The course includes six interactive team labs and a Digital Download Package. Students will learn how to assess and prioritize their top human risks and the behaviors that manage those risks, how to most effectively engage their workforce and drive behavior change, and how to measure the impact of these changes. AI is extensively integrated throughout the class, covering not only the latest AI risks facing your workforce but also how to leverage AI to amplify your impact. This is the only SANS short course that provides the industry-recognized SANS Security Awareness Professional (SSAP) certification. The course content draws from lessons learned across hundreds of global programs, offering both instructor guidance and extensive peer interaction.

Strategic Human Risk Management for Security Professionals

Today’s cyber threat actors are focusing less on technology and more on exploiting people. Human Risk Management provides a systematic way for organizations to protect their workforce—now the primary target and greatest source of risk.

Learn the key lessons and understand the roadmap to building a mature awareness program that will truly engage your workforce, change their behavior, and ultimately support your efforts in managing human risk. Apply models such as the BJ Fogg Behavior Model, the Curse of Knowledge, the Golden Circle, and Kirkpatrick Evaluation Model, and learn about the Elephant vs. the Rider. Learn how to leverage the latest AI tools and manage the greatest AI risks facing your workforce, including vibe coding, plugins and agentic AI. You will learn how to assess and prioritize your top human risks and the behaviors that manage those risks, how to engage and secure your workforce by changing their behaviors, how to build a strong security culture, and how to measure the impact and value of all that change.

The course content is based not only on learning theory and behavior change models, but on lessons learned from hundreds of programs from around the world. You will learn not only from your instructor, but from extensive interaction with your peers. Finally, you will have the opportunity to earn the SSAP certification, the industry standard in managing human risk in cybersecurity, recognized by employers around the world.

Author Statement

"Having been actively involved in information security for more than 25 years, I have seen one constant factor: people are the number one attack vector for cyber attackers as organizations fail to properly enable and secure them. This problem is solvable. Once engaged, trained and enabled, your workforce will become your greatest asset, driving not only secure behaviors but ultimately a strong security culture. I am extremely excited about LDR433, as it provides you with a proven roadmap and the skills, resources, and community you need to effectively manage and measure your human risk."

- Lance Spitzner

What You'll Learn

  • Benchmark and advance your program's maturity level
  • Identify and prioritize your top human risks
  • Understand the sciences behind adult learning theory, cognitive biases, and behavior and organizational change
  • Gain actionable strategies to motivate and drive secure behaviors
  • Employ techniques to engage and build credibility with leadership and your security team
  • Leverage the latest AI tools to accelerate and amplify your impact
  • Implement approaches to measure and communicate your program's value

Business Takeaways

  • Communicate in terms of both business and risk, building your credibility and reputation, especially with leadership and your own security team
  • Identify and manage your organization's top human risks, including how AI is affecting them
  • Integrate human risk management with your organization’s broader risk management efforts
  • Build sustainable programs that foster a strong security culture
  • Demonstrate program value to leadership in business terms
  • Implement effective learning and behavioral change models
  • Leverage AI to maximize program impact and efficiency

Meet Your Author

Lance Spitzner
Lance Spitzner

Lance Spitzner

Fellow

Lance revolutionized cyber defense by founding the Honeynet Project. At SANS, he has empowered over 350 organizations worldwide to build resilient security cultures, transforming human risk management into a cornerstone of modern cybersecurity.

Read more about Lance Spitzner

Course Syllabus

Explore the course syllabus below to view the full range of topics covered in LDR433: Managing Human Risk. .

Section 1Identifying and Prioritizing Human Risk

Section 1 covers the fundamentals of human risk management, beginning with benchmarking your program's maturity and providing a roadmap for improvement. It addresses critical foundations including leadership support, program charter, and strategic partnerships, then covers risk management principles and how to identify and prioritize your top human risks.

Topics covered

  • Benchmark security awareness maturity
  • Leverage AI to accelerate human risk reduction
  • Understand human risk fundamentals and attacker methods
  • Conduct human risk assessments using Cyber Threat Intelligence (CTI)
  • Build leadership alignment, partnerships, and a strategic plan

Labs

  • Benchmark your program’s current maturity against your peers
  • Case Study: Identify and prioritize top human risks

Overview

Section 1 covers the fundamentals by specifically answering the question: What is human risk, and how can you effectively manage it? We start with students defining the maturity of their existing program, then provide a strategic roadmap for how to improve their program's maturity. We then cover critical foundations for a successful program: leadership support, program charter, and partnerships. We then cover the fundamentals of risk management and how to assess and prioritize your top human risks.

Full Lab Details

  • Benchmarking your program's maturity against your peers
  • Identifying top human risks in a team case study

Full Topic Details

  • How to map and benchmark your program’s maturity
  • The five stages of the Security Awareness Maturity Model
  • The fundamentals of risk and risk management
  • The definition of human risk and the three variables that define it
  • Why humans are so vulnerable, and the latest methods cyber attackers use to exploit these vulnerabilities
  • Steps to gain and maintain leadership support for your program
  • How to develop and leverage effective partnerships
  • Developing a strategic plan that prioritizes your organization's human risk, the behaviors to manage those risks, and changing those behaviors
  • A walkthrough on how to conduct a human risk assessment and how to prioritize your organization's top human risks, including leveraging the latest in Cyber Threat Intelligence (CTI)
  • How to identify and manage role-based risks

Section 2Identifying and Changing Behavior

Section 2 starts with identifying the behaviors that best manage your top human risks, and the common mistakes teams make. You will then apply the science of behavior change, adapt your program across cultures and regions, and create effective training modalities, using AI to accelerate and amplify your impact.

Topics covered

  • Behavior identification and prioritization
  • Behavior change models and cognitive biases
  • Engagement, marketing and communication strategies
  • Operationalize the latest training methods and modalities, with a heavy emphasis on how to leverage AI to accelerate and amplify your impact

Labs

  • Identify and prioritize key behaviors
  • Create, simplify and communicate an AI security policy

Overview

The second section begins with how to identify the key behaviors that manage your top human risks, including defining each behavior as a learning objective. We then cover how to change those behaviors at an organizational level, starting with the fundamentals of engagement and motivating change, then how to adapt your program to different demographics, cultures, and regions. Finally, we go into the latest methods and modalities to train and engage your workforce, with a heavy emphasis on how to leverage AI to accelerate and amplify your impact.

Full Lab Details

  • Identify and prioritize key behaviors
  • Creating, simplifying and communicating an AI security policy

Full Topic Details

  • Resources for your long-term success
  • How to identify and prioritize the top behaviors that manage your key human risks
  • Defining learning objectives and how they apply to learning theory and risk management
  • Fundamentals of behavioral sciences, including the BJ Fogg Behavior Model, the cognitive biases, the Curse of Knowledge, the Golden Circle and the importance of "why"
  • How you can effectively create an engagement strategy leveraging marketing models
  • Creating a training strategy leveraging the ADDIE and Kirkpatrick models
  • Top tips for effective global translation and localization
  • The effective use of imagery, with a focus on diverse or international environments
  • Planning and documenting your training campaigns
  • How to create the latest training modalities with maximum impact and minimum budget, including leveraging AI to amplify your reach and impact

Section 3Security Culture and Measuring Change

Section 3 focuses on organizational culture, security culture and embedding security in your organization's overall culture. We then cover metrics, including behavior, culture and strategic metrics. Students will learn how to communicate those metrics and their value to leadership and finish the class by creating an actionable implementation plan.

Topics covered

  • Career development for awareness professionals
  • Defining, assessing and aligning security culture
  • Incentive programs for sustainable behavior
  • Building and managing a mature ambassador program
  • Metrics, a strategic metrics framework and a final action plan

Labs

  • Analyze and align security with your organizational culture
  • Create a comprehensive action plan

Overview

This section begins with culture, specifically defining what culture is, what your organization’s overall culture is, what security culture is, and how to embed a strong security culture into your organization's overall culture. We then cover metrics, starting with why we want metrics in the first place and how to use them at a strategic level. We then do a deep dive into how to measure behavior and culture, employing strategic metrics and learning how to communicate the value of your program to leadership in business terms. We finish the class with how to put this all together into a customized, actionable plan with key tips for success.

Full Lab Details

  • How to understand, define, and align security with your organization's overall culture
  • Creating an action plan for when you return to your organization

Full Topic Details

  • Career development: Steps you can take to grow your credibility, position and compensation
  • What organizational culture is and how to define your organization's overall culture
  • What security culture is, the value of a strong security culture, and the most common indicators of both a weak and strong security culture
  • How to align with and embed a strong security culture into your organization’s overall culture, leveraging the concepts of organizational change
  • How to create a strong incentive program to sustain behavior change long term
  • A deep dive into Ambassador Programs
  • Fundamentals of metrics, including why we collect them and how to leverage them strategically
  • The difference between compliance metrics and impact metrics
  • A walkthrough of the three types of impact metrics: knowledge, culture and behavior
  • Identifying leadership’s strategic priorities and how to align your metrics with them
  • Putting an overall project plan together and executing it
  • Resources for success moving forward

Things You Need To Know

Important! Bring your own system configured according to these instructions.

A laptop or mobile device with the latest web browser is required to play the Cyber42 leadership simulation game.

The Cyber42 game used in this course is hosted on the Capture the flag competitions and cybersecurity training delivery platform. Students must have a computer that does not restrict access to Capture the flag competitions and cybersecurity training delivery. Corporate machines may have a VPN, intercepting proxy, or egress firewall filter that causes connection issues communicating with third-party websites. Students must be able to configure or disable these services to be able to access the Cyber42 game.

If you have questions about the laptop specifications, please contact customer service.

LDR433 training is recommended for a diverse range of individuals, including:

  • Security awareness, training, engagement or culture officers
  • Security management officials
  • Security Ambassadors or Champions officers
  • Security auditors, and governance, legal, privacy or compliance officers
  • Training, human resources and communications staff
  • Representatives from organizations regulated by industries such as HIPAA, GDPR, FISMA, FERPA, PCI-DSS, ISO/IEC 27001 SOX, NERC, or any other compliance-driven standard
  • Anyone involved in planning, deploying or maintaining a security education, training, influence or communications program

This course provides you with the opportunity to join the SANS Security Awareness Community Forum, a private, invitation-only community of over 2,000 security professionals passionate about the human side of cybersecurity. In addition, you will receive the following with the course:

  • Printed + Electronic course books that include slides with detailed notes for each slide
  • Digital Download Package containing digital copies of all the labs, supplemental materials, reports, templates and examples
  • MP3 audio files of the complete course lecture

This course is designed for both new security professionals and experienced ones looking to expand their expertise in human risk management. While an understanding of cybersecurity risk and/or a technical background can help, it is in no way required.

The LDR433: Managing Human Risk course is part of the SANS Cybersecurity Leadership curriculum. This is in the category of knowledge every security manager should know. This course then prepares learners for the advanced leadership portion of the SANS leadership curriculum. Advanced leadership courses feature specializations based on management roles. 

What Comes Next?

  • LDR521: Security Culture for Leaders: This course takes LDR433 to the next level by teaching you how to leverage the principles of organizational change to develop, maintain, and measure a security-driven culture.
  • LDR512: Security Leadership Essentials for Managers: This course provides an overview of how to manage different security technologies, controls, and frameworks, and how they work together. It is an excellent way to better understand how awareness of human risk and knowing how to manage it partners with other elements of security.
  • LDR514: Security Strategic Planning, Policy, and Leadership: This is SANS' most advanced course for senior security leaders, CSOs, and CISOs. It is an excellent way to better understand how awareness of human risk and knowing how to manage it support your organization at a strategic level.

Managing human risk is a structured approach to addressing the primary enterprise vulnerability: people. It involves identifying high-risk behaviors, changing targeted behaviors through engagement and training, building a strong security culture, and measuring the impact. Managing human risk transforms employees into active defenders against cyber threats.

LDR433 enhances your career by providing in-demand skills and the SSAP certification—a mark of distinction in human risk management. Participants gain practical frameworks for assessing risks, changing behaviors, and measuring program effectiveness that demonstrate strategic value to employers. As organizations increasingly recognize that people are both their greatest vulnerability and potential security asset, professionals who can effectively manage human risk become essential to security teams and are well-positioned for advancement into leadership roles.

Relevant Job Roles

Cybersecurity Curriculum Development (OPM 711)

Responsible for developing, planning, coordinating, and evaluating cybersecurity awareness, training, or education content, methods, and techniques based on instructional needs and requirements.

Explore learning path

Security Manager Training, Salary, and Career Path

Cybersecurity Leadership

Daily focus is on the leadership of technical teams. Includes titles such as Manager, Information Security Specialist, and Program/Project Leader.

Explore learning path

Course Schedule and Pricing

Have Questions?Contact Us

SSAP Credential Attempt

Add an SSAP credential attempt and receive free one practice test. View pricing in the info icons below.

OnDemand Course Access

When purchasing a live instructor-led class, add an additional 4 months of online access after your course. View pricing in the info icons below.

Group and Private Pricing

Enroll your team as a group or arrange a private session for your organization. We’ll help you choose the format that fits your goals.

Contact Sales
Showing 7 of 7

Learn Alongside Leading Cybersecurity Professionals From Around The World

  • Slide 1 of 3
    Overall just fantastic. I would love for my whole team to attend this training - invaluable and eye-opening knowledge, that I think will enable lots of good changes and growth. There's just SO MUCH amazing content here, and the delivery was fantastic.
    Luka MorkyteJPMorgan Chase
  • Slide 2 of 3
    Just what I needed.
    Philippe VaquerBureau Veritas
  • Slide 3 of 3
    The labs presented an effective way to grasp the material and present to others for good feedback.
    Michael U.U.S. Government
Slide 1 of 0

Benefits of Learning with SANS

Bryan Simon: Teacher Standing Next to Smartboard and Explaining Concept

Get feedback from the world’s best cybersecurity experts and instructors

OnDemand Mobile App

Choose how you want to learn - online, on demand, or at our live in-person training events

Close Up of Woman Holding a Pen and Documents

Get access to our range of industry-leading courses and resources