SANS Security Awareness & Culture Summit 2026

Wed, Aug 19 - Fri, Aug 28, 2026
2 Courses
12 CPEs (Summit Only)
English

Caesars Palace & Virtual (PT)

3570 Las Vegas Blvd South, Las Vegas, NV 89109

Jump to:

Event Highlights
Courses
Speakers
Sponsors
Schedule
Location

Summit: Aug 27-28 | Training: Aug 19-26 | Summit Co-Chairs: Lance Spitzner & Hannah Hardee | In-Person and Live Online Summit CPE Credits: 12

Advancing Security Culture

Slide 1 of 2
Slide 2 of 2

Join us for the 13th annual SANS Security Awareness & Culture Summit. Learn, connect, and share with thousands of fellow security awareness, behavior, and culture professionals from around the world. Whether you choose to attend in-person for an all-access experience, or Live Online for access to select talks, this event is designed to equip you with the tools and knowledge needed to drive meaningful security culture change.

"A phenomenal quality of information from industry professionals. I feel so empowered to enact change in my organization." - Kat Bergeron

What Attendees Say

Slide 1 of 3
As always, I have so many immediately actionable and down-the-road takeaways from this Summit that the value has already far exceeded the cost. This Summit will now be a permanent part of our OPA budget.
Geoff Parker
Slide 2 of 3
This is by far my favorite conference every year!
Maureen PremoCISA
Slide 3 of 3
I really enjoyed the different approaches to Security Awareness — from the tactical to the strategic, and from the basics to some really groundbreaking ideas and innovations.
John Woodling

Summit Highlights

In-Depth Talks and Sessions

Top practitioners share research, tech, and case studies on shifting not just behavior, but attitudes and beliefs about cybersecurity. Explore proven advances in how to engage, communicate with, and secure your workforce.

SANS Security Awareness & Culture Summit 2026: Woman Presenting on a Stage

Workshops

For those attending in-person, engage in interactive, hands-on workshops, providing you with practical takeaways you can immediately implement.

People Watching a Presentation in A Summit Room

Media Partner: Ant Davis / Risky Creative

Ant Davis is a security awareness practitioner, podcaster, and the founder of Risky Creative. At this year’s Summit, he’ll be on-site producing live streams and practitioner interviews, capturing real conversations from the floor and sharing them with the wider security awareness community.

One-of-a-Kind Networking

This Summit is all about building community. Connect with industry experts, and your peers over round-table discussions, breaks, meals, evening receptions.

Summit Social

The days will be filled with the latest in advancing security culture, but the fun goes up a notch at night for those joining us in Las Vegas. Enjoy food, drinks, and fun as you make new connections with fellow attendees.

World-Class SANS Security Awareness Courses

Enhance your knowledge base and add to your toolkit by bundling your Summit experience with a hands-on, immersive course taught by top SANS instructors and course authors before the Summit.

Register

Summit and Course Registration

$5,250 USD

In personIncludes

Course: Live Instructor Training with Hands-on Exercises
Summit: Talks, Presentations and Workshops
Summit: Unmatched Networking
Summit: Evening Reception
Summit: Access to Exhibit Hall
Summit: Light Breakfast, Lunch, and Breaks with Snacks and Beverages

Select course to Enroll

Live onlineIncludes

Course: Virtual Live Instructor Training with Hands-on Exercises
Summit: Access to Select Talks
Summit: Interactive Chat on Slack
First Access to Approved Recordings and Decks

Select course to Enroll

Summit Registration Only

Free

$525 USD*Prices exclude applicable local taxes

In personIncludes

Talks, Presentations and Workshops
Unmatched Networking
Evening Reception
Access to Summit Exhibit Hall
Light Breakfast, Lunch, and Breaks with Snacks and Beverages
First Access to Approved Recordings and Decks

Attend In PersonLogin to register

Free

Live onlineIncludes

Access to Select Talks
Interactive Chat on Slack
First Access to Approved Recordings and Decks

Important Dates

Refund Deadline:: August 7, 2026
Hotel Group Discount Deadline:: July 23, 2026

Courses

Looking for Group Purchasing? Contact Us

Showing 2 of 2

Filter by:

LDR512: Security Leadership Essentials for Managers

LDR512Cybersecurity Leadership

GIAC Security Leadership
5 Days
30 CPEs
My-Ngoc Nguyen

Starts 19 Aug 2026 at 8:30 AM PT
$8,260 USD (Course)
$999 USD (Certification)
*Prices exclude applicable local taxes

Starts 19 Aug 2026 at 8:30 AM PT
$8,260 USD (Course)
$999 USD (Certification)
*Prices exclude applicable local taxes

View course details

LDR433: Managing Human Risk

LDR433Cybersecurity Leadership, Artificial Intelligence

SANS Security Awareness Professional
3 Days
18 CPEs
Lance Spitzner

Starts 24 Aug 2026 at 8:30 AM PT
$5,250 USD (Course)
$719 USD (Certification)
*Prices exclude applicable local taxes

Starts 24 Aug 2026 at 8:30 AM PT
$5,250 USD (Course)
$719 USD (Certification)
*Prices exclude applicable local taxes

View course details

Advisory Board

Lance Spitzner

Director, Workforce Cybersecurity Training at SANS Institute

Lance revolutionized cyber defense by founding the Honeynet Project. At SANS, he has empowered over 350 organizations worldwide to build resilient security cultures, transforming human risk management into a cornerstone of modern cybersecurity.

Learn more

Hannah Hardee

Cybersecurity Analyst at Southwest

Hannah Hardee is a Technology Analyst at Southwest Airlines that works to strengthen the organization against digital threats while cultivating her team into industry thought leaders.

Learn more

Anna Pieczątkowska

Cybersecurity Culture and AI Adoption Advisor at Cyber Aperitivo

Anna Pieczątkowska is a recognized human risk management expert with 15+ years of training experience and 8 years creating innovative cybersecurity strategies.

Learn more

Candice Smart

CISO at Cooperative Business Services, LLC

Candice Smart is a seasoned cybersecurity executive with over a decade of experience driving strategic transformation and operational excellence in the financial services sector.

Learn more

Holly Knowles

Culture, Training and Awareness Lead at Pacific Life

At Pacific Life, Holly's role encompasses risk culture management, employee and contractor training, simulated phishing messages, the creation of branded internal training videos and awareness materials, and the facilitation of quarterly BeSAFE awareness events

Learn more

Cheryl Wong

Cybersecurity Culture and Behavior Change Leader

Cheryl is a cybersecurity leader specializing in security culture and behavior change, with a strong focus on embedding practical, people centered security practices across organizations.

Learn more

Thank You to Our Partners

Schedule

Summit Dates

Thursday, August 27th - Friday, August 28th

Training Dates

Monday, August 24th - Wednesday, August 26th

Showing 1 of 43

Filter by:

Select day:

SANS@Night: Your Workforce is Using AI. Now What?

AI is already in your workplace. From generative tools that create content in seconds to emerging agentic systems that can plan and take action, your workforce is experimenting, often without fully understanding the risks or responsibilities.

This webcast gives security awareness and culture leaders a clear, accessible primer on generative and agentic AI, followed by practical guidance on what to teach your people. Through live demonstrations and real-world examples, we’ll focus on enablement over restriction, equipping your workforce to use AI confidently, productively, and securely.

Define generative AI and agentic AI in practical, non-technical terms
Identify the key human-centered risks associated with generative and agentic AI
Define the key behaviors that manage those risks
Design an enablement-driven AI awareness strategy.

06:00PM - 07:00PM PDT

In-Person

Presented by

Lance Spitzner

Director, Workforce Cybersecurity Training at SANS Institute

Early Bird Registration & Networking

Arriving in Las Vegas early? Join us the evening before the Summit for Early Bird Registration and Networking. Pick up your Summit credentials, reconnect with colleagues, meet fellow attendees, and start building new connections before the event officially begins.

04:00PM - 05:30PM PDT

In-Person

Breakfast & Credential Pick Up

07:30AM - 09:00AM PDT

In-Person

Opening Remarks

09:00AM - 09:20AM PDT

In-Person & Virtual

Presented by

Lance Spitzner

Director, Workforce Cybersecurity Training at SANS Institute

Hannah Hardee

Cybersecurity Analyst at Southwest

Table Top Introductions: Get to Know Your Neighbor

09:20AM - 09:40AM PDT

In-Person & Virtual

The Human Factor: What Working in Espionage Taught Me About Behavior, Trust, and the People Around You

Before someone will betray their country, they must trust you completely.

Shawnee Delaney spent nearly a decade as a clandestine case officer for the Defense Intelligence Agency recruiting and running spies in denied areas, hostile environments, and combat zones.

Her job wasn't just gathering intelligence. It was engineering trust under the most adversarial conditions imaginable, with people who had every reason not to trust anyone.

What she learned is that trust isn't a feeling. It's a system. And the same psychological principles that drive an asset to hand over classified information shape every high-stakes relationship in business - with your team, your clients, your board, and your adversaries.

In this session, Shawnee decodes the operational science behind human connection: how intelligence professionals identify what drives a person, establish influence without manipulation, and build relationships that hold under pressure. You'll walk away understanding how trust is actually constructed, where it breaks down, and what it costs you when it does.

This isn't soft skills. This is tradecraft.

09:40AM - 10:20AM PDT

In-Person & Virtual

Presented by

Shawnee Delaney

CEO at Vaillance Group

Break

10:20AM - 10:40AM PDT

In-Person & Virtual

Awareness Isn’t the Problem: Why Environment Design Drives Human Cyber Risk

Why do human driven cyber incidents keep repeating, despite years of awareness and training? Because most security decisions are not made in classrooms. They are made under pressure, in poorly designed processes, with tools and workflows that quietly reward insecure behavior.

This session challenges the awareness only mindset and introduces a practical shift in human risk management: designing operational environments where secure behavior becomes the easiest path, not the hardest one.

Through real world examples, you will learn how processes, systems, and constraints shape behavior at scale. The focus is not on perfect programs, but on how to spot high risk moments and redesign conditions so people can do the right thing by default.

Awareness informs. Training guides. But the environment decides.

In this session, you will learn how to:

• Identify the most predictable human attack surfaces and how everyday environments create them

• Redesign processes and systems so secure behavior becomes the easiest, default choice

• Combine awareness, training, and environment design into a scalable strategy for measurable human risk reduction

10:40AM - 11:05AM PDT

In-Person & Virtual

Presented by

Elodie Bridoux

Cyber Human Risk Management at Schneider Electric

Simulated, Not Communicated: How Broken Feedback Loops Undermine Security Awarenes

Across many organizations, a pattern repeats itself. Phishing simulation runs. Results go to senior leadership. Employees who were tested hear nothing. No one knows if the organization passed or failed. A few months later, nothing has changed.

Working in technology and risk consulting outside the security function, I had an angle on this pattern that practitioners often do not. The problem was never the simulation design. It was the silence after it. The communication loop was broken by default, and the industry had normalized it.

The SANS Security Awareness and Culture Maturity Model names this failure precisely. Stage 2, Compliance Focused, measures success by completion rates with no metric for communicating results back to employees. Stage 3, Promoting Awareness and Behavior Change, is where phishing clicks and report rates first appear. The model identifies the crossing point. What does not spell out is the communication mechanism that gets organizations there. That is what this session addresses.

The research confirms that Stage 2 is where most organizations are stuck. KnowBe4's 2025 report found a baseline phish-prone rate of 33.1% across 14.5 million users. Organizations with structured follow-through reduced that to under 5% within 12 months. Hoxhunt data shows a 7% threat reporting rate in compliance-driven programmes versus over 20% in mature behavior change programmes. The difference is not the simulation. It is what happens after it.

Attendees will leave with two things. First, a five-step communication sequence for closing the feedback loop after any phishing or vishing simulation, covering timing, audience segmentation, and plain-language message framing. This is the practical mechanism for crossing from Stage 2 to Stage 3. Second, a long-term framework for progressing through Stages 4 and 5, drawn from behavior change evidence in adjacent fields and deliberately presented as an open industry debate, because the industry does not yet have consensus on what sustained culture change looks like at scale. That conversation needs to start somewhere.

Live Online

10:40AM - 11:05AM PDT

Virtual

Presented by

Pallavi Parab

Vulnerability Management Engineer

How Security Culture Professionals Stay Relevant in the Age of AI

Artificial intelligence (AI) is already reshaping Security Culture and Awareness work. From drafting communication to generating phishing simulation ideas and creating short videos in a couple of minutes. For many practitioners, that creates both opportunity and anxiety: if AI can do the work faster and cheaper, how will this change our role?

In this session, Daisy Wong and Cheryl Wong will explore how Security Culture and Awareness professionals can embrace AI without becoming obsolete. Using the practical concepts of Human in the Loop and Human on the Loop, they will show attendees what can be automated, what needs oversight, and what must remain human-led.

This talk uses real world awareness examples and will go beyond content generation and focus on the capabilities AI cannot replace: strategic thinking, empathy, storytelling, stakeholder influence, and the ability to build trust across an organisation. Attendees will leave with a practical framework to help them use AI responsibly, protect the human value of their role, and reposition themselves as strategic leaders in human risk management.

11:10AM - 11:35AM PDT

In-Person & Virtual

Presented by

Cheryl Wong

Cybersecurity Culture and Behavior Change Leader

Daisy Wong

Head of Security Awareness at Mediabank

Security Culture by Design: Using Behavioral Analytics to Reduce Human Risk in High-Exposure Teams.

Security culture does not improve through annual training, awareness posters, or phishing failure shaming. It improves when it is intentionally designed, measured, and continuously optimized using behavioral intelligence.

This session explores how organizations can move beyond traditional awareness programs and operationalize security culture using data-driven human risk management principles. Drawing from real-world enterprise experience in a multinational environment, this presentation demonstrates how phishing simulation trends, role-based exposure, reporting behavior, repeat failure patterns, and departmental risk concentrations can be transformed into actionable behavioral insights.

Attendees will learn how to identify high-exposure teams, interpret behavioral signals beyond simple click rates, and design targeted interventions that reduce risk without eroding trust. The session will also explore how to shift conversations from “who clicked” to “why risk exists,” aligning security culture initiatives with enterprise risk management and leadership priorities.

Rather than treating employees as the weakest link, this talk reframes them as a measurable and influenceable security control. Participants will walk away with a practical framework for designing security culture intentionally — integrating behavioral analytics, communication strategy, and leadership engagement into a scalable human risk model.

If you are looking to evolve your awareness program into a mature human risk management function that produces measurable outcomes, this session provides both strategic perspective and operational guidance to begin that transformation.

Live Online

11:10AM - 11:35AM PDT

Virtual

Presented by

Pratik Singh

Cybersecurity Training and Awareness Lead at Fresenius Medical Care, Bangalore

Your Security Awareness Program is a Talent Strategy: Managing Workforce Risk Beyond Training

Security awareness programs often focus on training content and phishing simulations — yet one of the largest drivers of human cyber risk is workforce instability, skills gaps, and retention challenges.

In this session, Deidre Diamond will explore how security awareness leaders can think beyond training delivery and begin managing workforce risk as part of a broader talent strategy. Drawing from decades of experience in cyber talent intelligence and workforce risk management, she will outline how hiring, onboarding, internal mobility, and retention directly impact organizational security posture.

Attendees will learn:

How workforce churn and burnout increase measurable cyber risk
The hidden risk signals inside hiring and retention data
How to partner with HR to align awareness programs with talent lifecycle stages
Practical ways to reduce risk through smarter workforce planning
How to communicate workforce risk to leadership in business terms
Common mistakes organizations make when separating security training from talent strategy

Participants will leave with a practical roadmap to shift from viewing awareness as a compliance requirement to treating it as an integrated workforce risk management function — one that strengthens culture, reduces vulnerability, and supports long-term resilience.

Live Online

11:40AM - 12:05PM PDT

Virtual

Presented by

Deidre Diamond

Founder and CEO at CyberSN

Lightning Talks

Sara Mikail | From CISO Says No to Partner in Yes

Tim Ward | How Understanding Behavior Reduces Security Risk

Gabi Beasca | What a Spicy Campaign Can Teach Us About Executive Buy-In

Elsie Brown | What AI Becomes the Crisis: What 100+ Simulations Reveal About Human Behavior Under Pressure

Kerry Tomlinson | Unmasking Deepfake Deception: Inside a Celebrity Cyber Scam

From CISO Says No to Partner in Yes | Sara Mikail

Security teams are often branded as the “Department of No.” Policies block progress, controls slow teams down, and the CISO office becomes the villain in the room. We had the same problem and decided to tackle it not with more rules, but with culture. In this lightning talk, I’ll show how we used creative, experience-driven formats to shift that perception and build a lasting security culture across the organization.

How Understanding Behavior Reduces Security Risk | Tim Ward

In this talk Tim introduces the psychology and behavior science behind how we make decisions under pressure. From Kahneman’s System 1 and System 2, through deeper behavioral models that offer real insight into why our people do what they do. People-centric security risk isn’t an awareness or engagement problem, it’s a behavioral challenge. And so an understanding of how we really think, learn and behave at points of risk is fundamental to target and measurably change behavior. Tim will explore Dual Process Theory, nudge theory models like EAST and MINDSPACE, behavior models such as ABC and B=MAP. And offer some simple guidance as to how to use these in your programmes.

Gabi Beasca | What a Spicy Campaign Can Teach Us About Executive Buy-In

A lot of executive buy-in looks the same: a leader forwards the memo, says it matters, and expects the team to follow through. That may drive compliance, but it doesn't always create real influence. In this lightning talk, I’ll share what one 'spicy' campaign taught me about a more visible, human version of executive buy-in. Using a hot-wings-style leadership interview as the example, I’ll show how a high-visibility ask turned into a meaningful leadership moment; not because it was easy, but because it was thoughtfully positioned. This isn't a talk about copying one campaign. It's a talk about rethinking what buy-in can look like when leaders do more than sign off from a distance. Attendees will leave with three practical takeaways they can apply right away: how to choose the right leader to start with, how to position a bigger ask so it feels worth saying yes to, and how to design leadership moments that create momentum beyond a single video or event.

Elsie Brown | What AI Becomes the Crisis: What 100+ Simulations Reveal About Human Behavior Under Pressure

Your employees completed the phishing training. Your executives attended the tabletop. Your awareness program scored its highest engagement numbers yet. So why, when a deepfake of the CFO authorizes a fraudulent transfer, does the organization still fail to catch it in time?

Kerry Tomlinson | Unmasking Deepfake Deception: Inside a Celebrity Cyber Scam

A cyber news reporter takes you along as she goes undercover in a celebrity cyber scam to show you the tools and tactics that scammers are using to steal your money. The scammers in this real-life investigation deployed deepfake images, video and voice to pose as a famous singer. This session will examine how they utilized AI technology to further the crime, side by side with psychological tricks to manipulate us into compliance. Celebrity scams robbed victims of an estimated $5 billion in 2025. This talk will illustrate the latest cyber criminal strategies and the use of deepfakes, not just in this scam but in many others you face at work and at home. You’ll leave with practical strategies and awareness training tips to help your team recognize and resist deepfake-driven scams, even when you can’t trust your own eyes and ears.

11:40AM - 12:30PM PDT

In-Person & Virtual

Presented by

Tim Ward

CEO and Co-Founder at Redflags

Gabi Beasca

IT Risk and Compliance Lead

Sara Mikail

Cyber Awareness Specialist at Swisscard AECS

Elsie Brown

Founder & CEO at Resilian

Kerry Tomlinson

Cybersecurity News Reporter at Ampyx News

What Would You Do? Using SJTs to Reveal Security Culture and Guide Interventions

Most organizations measure security culture through surveys, phishing simulations, and training metrics. While useful, these approaches often miss something critical: why employees make the decisions they do. Without understanding the underlying type of security culture in an organization, interventions can feel generic, misaligned, or ineffective.

This session introduces a practical, behavior-focused approach to measuring security culture using Situational Judgment Tests (SJTs), paired with other lightweight methods practitioners can apply in their own environments. SJTs present realistic scenarios and ask employees how they would respond, revealing patterns in decision-making that traditional metrics overlook. The result is a clearer picture of how security is actually understood, prioritized, and acted upon across the organization.

Using real-world examples from a global energy firm, this talk will highlight how different cultural patterns shape employee responses to security expectations and initiatives. Attendees will gain insight into how these patterns influence behavior in ways that are not visible through traditional metrics alone.

This session is not about adding another measurement tool. It focuses on shifting how we think about security culture, from something we broadly assess to something we can diagnose and act on. By the end of the session, attendees will understand why measuring the type of security culture matters, how to begin identifying it within their own organization, and how those insights can be used to better target interventions, training, and communication strategies.

Whether you are leading a security program or designing awareness efforts, this session will provide a practical starting point for moving beyond surface-level metrics toward more meaningful, behavior-driven insights.

Live Online

12:10PM - 12:35PM PDT

Virtual

Presented by

Corey Bolger

Co-Founder and Principal Trainer at Security & Culture Cyber Interventions Co.

Samantha Phillips

Co-Founder and Culture Strategist at Security & Culture Cyber Interventions

Lunch

12:30PM - 01:30PM PDT

In-Person & Virtual

You Can’t Spot What Looks Real: Rethinking Security Awareness in the Age of AI, Deepfakes, and Autonomous Attackers

We’ve made real progress in security awareness, helping people recognize and respond to threats more effectively than ever before. But what happens when the threats no longer look like threats at all?

AI-generated phishing is now highly personalized and context-aware. Deepfakes can convincingly replicate trusted voices and identities - at the click of a button on widely available platforms that have no technical barrier to entry. And emerging autonomous agentic AI introduces something fundamentally new: systems that can initiate, sustain, and adapt interactions with humans over time.

In this environment, detecting social engineering and scams becomes unreliable, even for experienced professionals.

This keynote argues that the future of human risk management is not about improving detection, but about supporting better decisions under uncertainty. Drawing on behavioral science, real-world examples, and observed attack patterns, this session introduces a practical shift for awareness and culture leaders: from detection-based training to decision-focused design.

Attendees will leave with clear, actionable ways to evolve their programs, including how to redesign phishing simulations to reflect AI-era realism, introduce effective verification behaviors into workflows, and move beyond click-based metrics toward measures of decision quality.

This is not a technical deep dive into AI. It is a practical roadmap for those responsible for influencing behavior at scale, designed to help organizations build resilience in a world where attacks are increasingly convincing, persistent, and human-like.

01:30PM - 01:55PM PDT

In-Person & Virtual

Presented by

Dr. Jessica Barker

Co-CEO at Cygenta

WORKSHOP | Vibe Coding for Security Awareness: Build an Interactive Training Experience with AI (No Programming Required)

Security awareness teams are expected to create engaging, interactive training, but many lack the time, budget or development resources to build anything beyond static content. This hands-on workshop introduces vibe coding: a practical approach to using generative AI as a creative and technical partner to co-build interactive training experiences; without traditional coding skills.

Participants will code along in real time as we collaboratively build a complete security awareness learning experience from scratch. Using AI prompts, lightweight logic, and common learning tools (e.g., Articulate Storyline, Rise, or equivalent platforms), attendees will design scenarios, interactions, branching logic, and assessments that can be reused in their own programs. This workshop prioritizes doing over watching.

Attendees will leave with:

A working training asset
A repeatable AI-assisted workflow
Prompt examples they can immediately reuse
A clear understanding of what AI does well, and where humans must stay in control

We will intentionally share mistakes, failed prompts, and governance challenges encountered along the way.

Hands-On Workshop Project

Project: Build a short, interactive security awareness training experience (e.g., scenario-based module, microlearning, or branching quiz)

Participants will collaboratively:

Define a learning objective and behavior change goal
Use AI to generate scenarios, decision points, and feedback
Translate AI output into an interactive format inside a learning tool
Iterate prompts to improve quality, tone, and clarity
Validate accessibility, consistency, and governance considerations

No prior coding or AI experience required.

01:30PM - 02:50PM PDT

In-Person

Presented by

Rebecca Arnett

Senior GRC Analyst at Blue Cross and Blue Shield of Louisiana

Treat People Like Adults: How Trusting Employees Transformed Security Training at Postman

At Postman, we recognized that traditional security awareness training was failing. It didn’t make the company safer but it did make our employees cranky.

So we decided to take a step back and ask ourselves:

How do we stay compliant while respecting employees' time?

How do we deliver training that meets people where they are?

How do we know it’s working?

Our approach flipped training on its head. Instead of forcing everyone through the same mandatory course, we introduced a test-out option: prove you know the material, and you're done. For everyone else, we replaced passive video-and-quiz formats with one-minute micro-modules followed by hands-on experiential assessments. The results were immediate. Employees started vociferously and publicly praising security training — some even asked to take it again. Our security engineers called the positive feedback "genuinely wild."

We also ran our first "Phish Fry" during Cybersecurity Awareness Month: a reporting-focused competition that rewarded employees for spotting and flagging threats rather than punishing those who clicked.

This talk covers three actionable shifts any security awareness team can make:

Offer a test-out. We'll share exactly how we structured ours, the completion data that justified it, and the message it sends to your workforce about respecting their expertise.
Replace quizzes with experiential assessments. We'll walk through the difference between recognition-based and application-based testing and why it matters for actual behavior change.
Reframe phishing simulations as celebrations, not gotchas. We'll break down the Phish Fry format — the contest mechanics, how we positioned reporting over clicking, and what we'd change next time.

You'll leave with a concrete playbook for making these changes in your own program.

02:00PM - 02:25PM PDT

In-Person & Virtual

Presented by

Ashley Savageau

Security Awareness and Training Manager at Postman Inc.

Harley Sugarman

Founder and CEO at Anagram Security

Findings of SANS Annual Report

02:25PM - 02:50PM PDT

In-Person & Virtual

Presented by

Lance Spitzner

Director, Workforce Cybersecurity Training at SANS Institute

Rachael Saffer

Global Product Marketing Manager at SANS Institute

Break

02:50PM - 03:10PM PDT

In-Person & Virtual

Security's Identity Problem: Why We Fail Our Internal Customers

I spent six months redesigning a security team's materials. New structure, clearer guidance, knowledge organised around the questions people ask. It looked great. Within six months, the team reverted to blocking behaviours. We'd rearranged the furniture without changing how security saw itself.

That failure taught me something most security culture programmes miss. We spend effort on the visible layer: policies, awareness campaigns, reporting dashboards. When nothing sticks, we blame "the culture." But the root cause is deeper: the security function's own identity. How a security team defines its purpose shapes every interaction the organisation has with it.

Existing frameworks target the awareness programme and its maturity. This talk targets what sits beneath: the security team's self-concept. "We protect the organisation" and "we serve the organisation" produce completely different behaviours, metrics, and relationships with the business.

I'll introduce a sequenced model for identity-first culture change, tested across two organisations: a technology consultancy and a UK government body. The sequence matters. Change identity, then incentives, then narratives, then systems. The visible behaviours follow. Reverse that order (start with systems, hope behaviours stick) and you get my failure story.

I'll share specific artefacts: persona cards for security's customers, service menus that replaced document libraries, and the metrics that replaced "exceptions denied." I'll address the risk nobody calculates: the cost of security information not reaching the people who need it.

You'll leave with:

A five-step sequence for identity-first culture change
A customer experience audit you can run next week
Measurement approaches that show the shift is working
Language for making the case to leadership, even if you don't set the metrics yourself

03:10PM - 03:35PM PDT

In-Person & Virtual

Presented by

Lee Richardson

Cybersecurity Consultant at FSP Consulting

WORKSHOP | From Posters to Partners: A Security Awareness Officer's Hands-On Playbook for Integrating with SOC, GRC, and Security Architecture

Let's name the thing nobody says out loud: most security awareness officers are the only person on the security team who's never invited into operational conversations. The SOC doesn't ask for your input. GRC doesn't include you in risk assessments. Security Architecture doesn't consult you on control design. You make posters. You send phishing simulations. You wonder if anyone takes you seriously. This workshop exists to change that - permanently!

In 120 minutes, you'll build three integration playbooks drawn from real processes we've run across +30 organizations. Not theory. Not "wouldn't it be nice." Actual workflows you can adapt and execute starting Monday.

Playbook 1: SOC Partnership. You'll map human risk indicators - role, data access, behavioral risk signals, VIP trust relationships - to alert prioritization in your incident management workflow, giving analysts the context they need and taking low-risk incidents off their plate entirely. You'll design a user self-remediation process that reduces SOC noise by 60%.

Playbook 2: GRC Partnership. You'll build a human risk overlay for a real security risk assessment. Most risk registers account for Process and Technology. People are either missing or reduced to "training completed: yes/no." You'll fix that, ensuring risk assessments and associated risk treatment plans reflect actual human risk factors.

Playbook 3: Security Architecture Partnership. You'll identify controls that introduce security friction, call out where human risk factors drive exposure, and redesign controls so the secure path is the easy path.

You'll leave with three ready-to-deploy playbooks, conversation scripts for approaching each team, and a 90-day integration roadmap.

This workshop is for security awareness officers who are done being the poster people and ready to become indispensable partners to their CISO and security team. Take and implement the playbooks that earn you a permanent seat at the table.

03:10PM - 04:35PM PDT

In-Person

Presented by

Flavius Plesu

Founder at OutThink

Damon DePaolo

Cybersecurity Awareness and Training Lead at CVS Health

The Behavioral Patch: Turning Incident Response Post-Mortems into Insider Risk Mitigation

For a long time, Security Awareness and Incident Response teams operated as separate silos. CSIRT handles technical breaches, while Awareness teams lead compliance and education initiatives. However, there is little structured exchange between these functions. This disconnect creates a critical intelligence gap:

CSIRT sees the "how" of a breach, but Awareness teams lack the real-world data to prevent the "why."

Drawing on my experience at a leading cryptocurrency company, I will provide a framework to establish a data-driven alliance between the Awareness team and CSIRT, enabling companies to move beyond generic training and deploy highly targeted strategies to implement behavioral interventions that make sense for each organization's unique environment.

By leveraging real-world incident data, companies can more effectively mitigate a broad spectrum of unintentional insider risks, starting with phishing, but extending to critical vulnerabilities like leaked credentials, unauthorized shadow IT, and social engineering.

Attendees will leave with practical strategies to:

Initiate the Partnership and Deconstruct the Silos: Tips for Awareness leaders to "speak the language" of the CSIRT to open communication channels and build a recurring “risk sync”.

Look Beyond the Inbox: Identifying human risks that go far beyond phishing by leveraging the direct support of CSIRT data.

Close The Intelligence Loop: Proven methods for translating technical IR post-mortems into actionable security interventions that provide clear, "human-ready" guidance for your users.

Ensure Measurable Impact: KPIs that prove how awareness reduces IR ticket volume, change behavior of the users and improves mean-time-to-remediate (MTTR).

Through this partnership, security awareness becomes more deeply embedded into the organizational culture, transforming it from a compliance requirement into a core business value. This data-driven approach provides the clear, operational evidence needed to secure executive buy-in and demonstrate the tangible ROI of human risk management.

03:40PM - 04:05PM PDT

In-Person & Virtual

Presented by

Grazielle Alessa

Sr. Cybersecurity Lead at Mercado Bitcoin

From Awareness to Intelligence: Brewing a Data Driven Human Risk Capability

Building a secure culture at scale it is quite a challenge, especially if you are responsible for driving awareness program in big, global companies - where local lenses make all the difference. We also have been there, trying our best to deliver meaningful awareness initiatives, utilizing mostly feedback about the local human risks.

Our dream was to have one data source that would help us focus on the most immediate risks and most importantly allow us to track the success of our initiatives - a metric based approach! So that is what we did. Joining forces with other security and data teams, we were able to design and build an in-house Human Risk Analysis Dashboard, including clear visualization of the real risk data cascaded to specific location and department.

We would love to share our journey, with all the successes and bumps along the way.

Join us if you would like to hear:

How we designed tailored framework for our own human risk scoring methodology
What was our journey in integrating all human risk related data
How we presented those data to leadership to gain their sponsorship
How we are moving from standard awareness to risk intelligence and crafted interventions

For us this is not only the story about the new “tool” we created, but about the proud moments of brining the real value to our leaders and security teams, who can now make decisions based on the real data we own. It’s also the story about how the passion of our awareness team turned into global solution and helped us prioritize what really matters. Like we say: 'Copy with pride' - we hope to inspire you, support with your journey and stay inspired by the community!

04:10PM - 04:35PM PDT

In-Person & Virtual

Presented by

Agata Labecka

Security Awareness Specialist & Chapter Lead Security at HEINEKEN

Sofia Garcia

Security Awareness Specialist at HEINEKEN

Day 1 Wrap Up

04:40PM - 04:50PM PDT

In-Person & Virtual

Presented by

Lance Spitzner

Director, Workforce Cybersecurity Training at SANS Institute

Hannah Hardee

Cybersecurity Analyst at Southwest

Human Map

The Human Map is a longstanding Summit tradition and a favorite among attendees. At the conclusion of the first day, we create a large world map on the venue floor and invite participants to stand in the location that represents where they live or work. This interactive activity provides a unique opportunity to quickly identify and connect with peers from your region, as well as meet professionals from around the world. Held immediately before the evening networking reception, the Human Map serves as a natural starting point for meaningful conversations and new professional connections.

04:50PM - 05:20PM PDT

In-Person

Summit Social

Get ready to light up the night at our Summit Social! Enjoy complimentary food, beverages, and live entertainment from String Me Along, a DJ and live violin duo known for keeping the energy high. Wear your favorite glow-in-the-dark attire and accessories and join fellow attendees for an evening of music, networking, and fun.

06:00PM - 08:00PM PDT

In-Person

Breakfast

08:00AM - 09:00AM PDT

In-Person

Opening Remarks

09:00AM - 09:10AM PDT

In-Person & Virtual

Presented by

Lance Spitzner

Director, Workforce Cybersecurity Training at SANS Institute

Hannah Hardee

Cybersecurity Analyst at Southwest

Table Top Introductions: Get to Know Your Neighbor

09:10AM - 09:30AM PDT

In-Person & Virtual

Panel Discussion: Gaining Credibility and Engagement with Key Partners | Moderated by Ant Davis

One of the biggest challenges our community faces is building credibility and buy-in from key partners, including leadership, communications, and even our own security teams. In this panel, practitioners share the tips, methods, and approaches that have actually worked for them in winning that trust and opening doors.

09:30AM - 10:10AM PDT

In-Person & Virtual

Facilitated by

Ant Davis

Founder at Risky Creative

Break

10:10AM - 10:30AM PDT

In-Person & Virtual

The Missing Security Program: A Framework for Customer Security Evangelism

Every SaaS platform invests heavily in securing its own infrastructure. Almost none invest in building the security capabilities of the people using it. That gap is where incidents live, and where this session starts.

Customer Security Evangelism is the structured practice of building security awareness, changing behaviours, and increasing capability within your customer base. It's widely practiced. It's nowhere formalized. No job description. No methodology. No measurement standard. This session changes that.

Drawing on a working program at Guidewire Software, a major insurance technology platform serving hundreds of enterprise clients, attendees will learn how to segment customers by security maturity and design communication that meets them where they are, not where you wish they were. You'll learn how to build a security narrative hierarchy: one version for the board, one for the security team, one for the end user, mapped to frameworks your customers already use. And you'll learn how to define behaviour change metrics that connect evangelism activity to measurable outcomes, the kind that protect program budgets when someone asks what you actually accomplished.

This isn't a product pitch. It's a blueprint drawn from behavioural science and social change communication, applied to the hardest problem in platform security: the people on the other side of your shared responsibility line.

You'll leave with a segmentation model, a narrative hierarchy, and a measurement approach you can start building on Monday.

Attendees will be able to:

Segment their customer base by security maturity and design programs that meet customers where they are
Build a three-level security narrative hierarchy mapped to frameworks that their customers already use
Define behaviour change metrics that connect evangelism activity to outcomes that leadership can fund

10:30AM - 10:55AM PDT

In-Person & Virtual

Presented by

Mark Sayewich

Director of Customer Security Evangelism at Guidewire Software

WORKSHOP | From Awareness to Action: Tackling Today’s Security Culture Challenges

Come ready to solve the problems every security awareness leader is dealing with right now.

Join Hannah and Pooja for a highly interactive roundtable where you’ll roll up your sleeves and tackle real program challenges alongside your peers.

We will examine problems such as:

Awareness is high, but behavior isn’t changing Leadership shows up… but only during incidents
AI adoption is outpacing awareness efforts
One global program, completely different regional behaviors
Business priorities are quietly bypassing security awareness
Cyber champion programs that are losing momentum over time
Social engineering simulations that go beyond phishing

You won’t just talk about these challenges; you will brainstorm realistic solutions using proven behavioral and program design approaches like EAST, Fogg, and ADDIE. Walk away with ideas you can take back and use immediately, plus a better sense of how other teams are navigating the same pressure points.

10:30AM - 12:25PM PDT

In-Person

Presented by

Hannah Hardee

Cybersecurity Analyst at Southwest

Pooja Srivastava

Human Centric Security Lead at Genpact

The Impact of Mental Health on Cybersecurity Behavior

Psychology draws a distinction between “states” which are short-term influences on behavior and “traits” which are more durable parts of an individual’s personality. Research typically focuses on traits but often neglects the more transient reasons why people take shortcuts or make suboptimal decisions.

In this talk, we will cover the impact of mental health on cybersecurity behaviors. The audience will learn about the toxic and corrosive effect of certain hormones and neurotransmitters on attention and working memory. Then, we will transition the discussion to resilience and cover how one overcomes adversity through positive adaptivity. Finally, we will conclude with a discussion of strategies for building positive mental health and connect those strategies back to positive cybersecurity behaviors.

11:00AM - 11:25AM PDT

In-Person & Virtual

Presented by

Dr. Bob Hausmann

Lead Cognitive Scientist, Human Risk Management at Proofpoint

Beyond the Screen: Engaging the "Unconnected" Workforce in the Age of AI

The most significant security gap in modern organizations isn't in the cloud; it’s on the front lines. While cybersecurity evolves at the speed of AI, a vast portion of the global workforce operates in physical, high-pressure environments with varying levels of digital maturity.

These employees are often neglected by traditional, screen-based awareness programs, leaving them—and their companies—vulnerable.

In this session, I will share the 'boots-on-the-ground' methodology I used to bridge the gap between corporate security and offline field operations, demonstrating how to transform a deskless, non-technical workforce into a proactive frontline of defense.

Key Takeaways:

Moving Beyond the Inbox: I will outline how to design "analog-friendly" strategies that resonate with operational roles, replacing ineffective weekly email blasts with high-impact physical triggers, on-site visual cues, and face-to-face engagement cycles that exist where the work actually happens.

Measuring Culture Without "Clicks": I will outline how to implement behavioral KPIs tailored for field operations, focusing on the voluntary reporting of physical risks and proactive peer-to-peer accountability. This methodology provides a true 360-degree view of human risk that reflects the operational reality of the front line.

Preparing the Non-Technical Workforce for AI: I will outline how to build a human-centric foundation that reframes security as a core professional trade skill. By anchoring security protocols into existing organizational values, I will show how to cultivate the psychological safety and trust required to operationalize advanced AI policies across a diverse, distributed workforce.

11:30AM - 11:55AM PDT

In-Person & Virtual

Presented by

Gustavo Giovanetti

Head of IT at Engeform Engenharia

Improving Mandatory Security Awareness Training Through Role Relevance and Gamification: Lessons from the Field

Mandatory security awareness training is widely deployed, yet frequently criticized for low engagement and limited impact on real-world behavior.

This case study shares how one global organization redesigned its mandatory program to address a specific challenge the awareness community continues to struggle with; how to make mandatory training meaningful, role-relevant, and behavior-focused—without adding time or burden. We will walk through how a traditional annual course was replaced with a modular, role-aware learning experience that adapts to employee context, tenure, and risk exposure, including non-office and operational roles. Rather than adding “games” for engagement alone, we applied lightweight gamification techniques—scenario-based decisions, challenges, and immediate feedback—to reinforce secure behaviors employees face in their day-to-day work.

The session focuses on what worked well, where assumptions failed, and what we had to course-correct. Lessons include balancing credibility with play, avoiding over-gamification, managing scalability across a global workforce, and resisting reliance on completion metrics as a success signal. Finally, we will share how the program is evolving: moving toward behavior-based measurement, deeper role differentiation, and tighter integration with phishing simulations and coaching. Attendees will leave with practical design principles they can apply to modernize mandatory training in their own organizations.

12:00PM - 12:25PM PDT

In-Person & Virtual

Presented by

Nadine Rose-Smith

Product Manager Secure Behavior Engagement and Training | IT Security & Compliance at Nestlé Global

Lunch

12:25PM - 01:30PM PDT

In-Person & Virtual

Stop Training People. Design Safer Moments: 7 Micro-Interventions to Reduce Everyday Data Mistakes

Security awareness teams face a difficult reality: employees are moving faster, sharing more, and increasingly using AI in everyday work.

Training completion may look great, yet familiar data mistakes still happen, a confidential file goes to the wrong recipient, an overly broad sharing link exposes sensitive content, permissions remain wider than intended, or customer data is pasted into an AI tool. Why? Because risk often appears in a real work moment, under time pressure, when the employee is simply trying to get the job done.

This session explores a practical alternative to relying on more training or broader reminders: designing safer moments directly into the flow of work. Drawing on lessons from large enterprise data protection and security programs, Pooyan Hamidi will walk through seven micro-interventions organized around when the risky decision happens—before, during, and after the action. You will see how safe defaults, classification at creation, workspace guardrails, just-in-time warnings, justification prompts, AI boundary reminders, and near-miss coaching can help people make safer decisions without unnecessarily slowing legitimate work. The session also covers an important lesson from implementation: even the right interventions can backfire when organizations launch too much at once, use vague policy language, create excessive friction, or measure activity instead of behavior. Attendees will leave with a practical approach for moving from human risk to a specific behavior, moment, intervention, and metric. You will also get a ready-to-use intervention selection checklist, a focused 30-day pilot approach, sample message patterns people will actually read, and a simple measurement model that shows leadership whether risky behaviors are going down and safer choices are becoming habits. The goal is simple: stop asking people to remember security at exactly the right second—and start designing safer choices into the moments that matter.

01:30PM - 01:55PM PDT

In-Person & Virtual

Presented by

Pooyan Hamidi

Cybersecurity and Data Protection Leader

WORKSHOP | Effort‑to‑Impact Champions (E2I‑C) Workshop: Build a Turnover‑Proof, Outcome‑Based Security Champions Program in Five Steps

Organizational changes shouldn’t derail your Security Champions program. In this hands‑on workshop, you’ll build a practical, outcome‑based operating model that survives leadership turnover.

Using the E2I‑C method (baseline → map → instrument → pilot → roll out), you’ll map activities to outcomes with the Connect / Find / Fix / Prevent (C/F/F/P) framework, define manager‑friendly metrics (visibility, consistency, AI readiness, behavior), and assemble a leadership dashboard leaders can evaluate and iterate. We’ll capture the metrics you can measure now, draft a data dictionary for those you can’t (yet), and design a pilot plan that withstands org changes and skeptical leadership. We’ll also address common pitfalls (like non‑aggregable scorecards) and show how to pivot to shared outcomes and turnover‑proof KPIs.

Attendees leave with: a Champion Charter, Outcome‑Mapping Worksheet, Dashboard Schema & Data Dictionary, a leader‑friendly brief, and a 90‑day rollout plan. The workshop is tool‑agnostic and focused on template-driven steps, behavior signals, and operating rhythms so you can demonstrate value and maintain support even as structures and budgets change.

01:30PM - 02:55PM PDT

In-Person

Presented by

Angela Rivas

Cyber Assurance Architect at Sandia National Labs

From a List to a Language: How SebDB Is Becoming a Behavioral Ontology and Answering the Four Questions Your Boss Is About to Ask You

Four people-related questions are increasingly being asked of security teams, yet most human risk management programs struggle to answer them. Which behaviors, and from which groups, are most likely to result in a breach? What is actually changing as a result of our behavioral interventions? Can we measure positive security behaviors, or only identify where they break down? And when we identify a behavioral risk, how precisely and quickly can we respond?

The reason these questions are so difficult to answer is not a lack of tools. It is a lack of a shared language. For years, our field has primarily reported simulation click rates, phishing reports, engagement metrics, and training completion rates because that was all our data could support. This session explores how SebDB, the open-source database of security behaviors, is evolving from a simple list into a comprehensive behavioral ontology that maps the relationships among behaviors, threats, risks, and controls. You'll also see how security professionals around the world are using SebDB to answer the most important human risk management questions and describe their programs using the language of risk.

Starting with the fundamentals, Oz will walk through the SebDB database and ontology in its simplest form before demonstrating how the same structure enables organizations to move from measuring activities to producing meaningful evidence, one question at a time. SebDB is open, free, and vendor-neutral. You'll leave with a practical framework for answering the four questions, an understanding of how to apply SebDB in your own program, and a clear perspective on why answering these questions is what makes you indispensable.

02:00PM - 02:25PM PDT

In-Person & Virtual

Presented by

Oz Alashe MBE

CEO and Founder at CybSafe

Solo Campaign: Building Security Culture When You're the Whole Department

You ARE the IT department. You are also the security team, the awareness program, and the culture change initiative. You have no budget, no dedicated staff, and a workforce that clicks through compliance training and forgets everything by Friday.

Nobody is coming to save you. But you already knew that. Good thing you like a challenge.

Clicking through an annual module isn't culture. Culture is what your staff does when nobody is watching. And this talk is about building exactly that.

At an alternative education nonprofit, I designed and ran a 12-week voluntary champion program using quest-based learning and fantasy-themed red team trials to reframe security from a compliance burden into something staff actually want to engage with. Here's the ground-level account: the wins, the wipes, and what I'd roll differently on a second playthrough.

You'll leave knowing how to scout champions by behavioral traits rather than technical skills, because the best security advocates in your building probably don't have "security" in their job title. You'll know how to run red team trials that teach rather than punish, with debrief structures that turn getting caught into a learning moment. You'll know how to build toward a tabletop exercise your staff is actually ready for, because champions deserve a victory lap before the boss battle. And you'll know how to design participation pathways that work across communication styles and neurotypes, because a security culture that only works for one kind of person isn't a security culture at all.

You'll walk away with the complete toolkit, ready to adapt for your own organization.

The security team you need is already in your building. Find them, train them, and more importantly, trust them.

02:30PM - 02:55PM PDT

In-Person & Virtual

Presented by

Liz Gore

Director of IT and Operations at Educators for Quality Alternatives

Day 2 Wrap Up

03:00PM - 03:20PM PDT

In-Person & Virtual

Presented by

Lance Spitzner

Director, Workforce Cybersecurity Training at SANS Institute

Hannah Hardee

Cybersecurity Analyst at Southwest

Caesars Palace

Hotel Special Rates and Reservations

A special discounted rate of $84.00 (Aug. 23–25) and $209.00 (Aug. 26–28), plus applicable taxes, will be honored based on availability. There is a daily discounted resort fee of $49.95 per room, per night, plus applicable state and local tax. Resort fee includes unlimited local phone calls (no long distance or international calls,) two guest admissions per day to the Fitness Center (does not include use of the spa,) in-room internet access to include two devices per room per day (property-wide roaming may be available for an additional fee.)

A limited number of Government Per Diem rooms at the prevailing rate are available with proper ID. Government rooms have a daily discounted resort fee of $10.00 per room, per night to include the benefits listed above. The full price resort fee will appear on the booking link, but the discounted rate will be applied at check-in.

The cut off date has passed, please reach out to bnix@sans.org for assistance in booking a reservation.

3 Reasons To Stay At The Event Venue

Ultimate Convenience
Eliminate the hassle of daily commutes and wasted travel time. You’ll have everything you need—from your training to dining and amenities - all in one centralized, convenient location.
Seamless Networking Opportunities
Stay where the action is! Maximize your chances to connect with fellow cybersecurity professionals and industry leaders - from impromptu conversations in the lobby to exclusive after-hours events.
All Day, All Event Access
SANS live training events include bonus sessions exclusively at the venue. Staying on-site ensures you won’t miss these opportunities to grow your network and engage with peers beyond the conference agenda.

More Information

Ant Davis is a security awareness practitioner with over 15 years of experience helping organizations build security cultures that actually stick. He’s the co-host of The Awareness Angle podcast, host of The Awareness Practitioners, an interview series giving a platform to the many voices working within the security awareness space, and founder of Risky Creative, a media brand covering the human side of cybersecurity. At this year’s Summit, Ant is joining us as an official Media Partner, producing live streams and practitioner interviews across both days of the event.

SEC536: Adversarial AI - Penetration Testing AI Systems

SANS Security Awareness & Culture Summit 2026

Share

Advancing Security Culture

What Attendees Say

Summit Highlights

In-Depth Talks and Sessions

Workshops

Media Partner: Ant Davis / Risky Creative

One-of-a-Kind Networking

Summit Social

World-Class SANS Security Awareness Courses

Register

Summit and Course Registration

Summit Registration Only

Courses

SSAP Certification

Extra 4 Months of Course Access

LDR512: Security Leadership Essentials for Managers

Quick view

LDR433: Managing Human Risk

Quick view

Advisory Board

Lance Spitzner

Hannah Hardee

Anna Pieczątkowska

Candice Smart

Holly Knowles

Cheryl Wong

Thank You to Our Partners

Schedule

Summit Dates

Training Dates

SANS@Night: Your Workforce is Using AI. Now What?

Early Bird Registration & Networking

Breakfast & Credential Pick Up

Opening Remarks

Table Top Introductions: Get to Know Your Neighbor

The Human Factor: What Working in Espionage Taught Me About Behavior, Trust, and the People Around You

Break

Awareness Isn’t the Problem: Why Environment Design Drives Human Cyber Risk

Simulated, Not Communicated: How Broken Feedback Loops Undermine Security Awarenes

How Security Culture Professionals Stay Relevant in the Age of AI

Security Culture by Design: Using Behavioral Analytics to Reduce Human Risk in High-Exposure Teams.

Your Security Awareness Program is a Talent Strategy: Managing Workforce Risk Beyond Training

Lightning Talks

What Would You Do? Using SJTs to Reveal Security Culture and Guide Interventions

Lunch

You Can’t Spot What Looks Real: Rethinking Security Awareness in the Age of AI, Deepfakes, and Autonomous Attackers

WORKSHOP | Vibe Coding for Security Awareness: Build an Interactive Training Experience with AI (No Programming Required)

Treat People Like Adults: How Trusting Employees Transformed Security Training at Postman

Findings of SANS Annual Report

Break

Security's Identity Problem: Why We Fail Our Internal Customers

WORKSHOP | From Posters to Partners: A Security Awareness Officer's Hands-On Playbook for Integrating with SOC, GRC, and Security Architecture

The Behavioral Patch: Turning Incident Response Post-Mortems into Insider Risk Mitigation

From Awareness to Intelligence: Brewing a Data Driven Human Risk Capability

Day 1 Wrap Up

Human Map

Summit Social

Breakfast

Opening Remarks

Table Top Introductions: Get to Know Your Neighbor

Panel Discussion: Gaining Credibility and Engagement with Key Partners | Moderated by Ant Davis

Break

The Missing Security Program: A Framework for Customer Security Evangelism

WORKSHOP | From Awareness to Action: Tackling Today’s Security Culture Challenges

The Impact of Mental Health on Cybersecurity Behavior

Beyond the Screen: Engaging the "Unconnected" Workforce in the Age of AI

Improving Mandatory Security Awareness Training Through Role Relevance and Gamification: Lessons from the Field

Lunch

Stop Training People. Design Safer Moments: 7 Micro-Interventions to Reduce Everyday Data Mistakes

WORKSHOP | Effort‑to‑Impact Champions (E2I‑C) Workshop: Build a Turnover‑Proof, Outcome‑Based Security Champions Program in Five Steps

From a List to a Language: How SebDB Is Becoming a Behavioral Ontology and Answering the Four Questions Your Boss Is About to Ask You

Solo Campaign: Building Security Culture When You're the Whole Department

Day 2 Wrap Up

Caesars Palace

3 Reasons To Stay At The Event Venue

Ultimate Convenience

Seamless Networking Opportunities