SANS Security Awareness & Culture Maturity Model™

Security awareness programs evolve over time. As programs mature, teams need a shared way to understand progress, define what good looks like at each stage, and prioritize where to focus next.

Updated for 2026, The SANS SecurityAwareness & Culture Maturity Model™ eBook provides a structured framework for assessing, planning, and evolving a security awareness program over time. It breaks maturity into five clear stages and explains what changes as programs move from foundational efforts to sustained, organization-wide security culture.

This eBook is designed to help security and risk leaders turn security awareness into a measurable, strategic program - not just a training requirement.

Discover:

• How the five stages of the maturity model are defined, from non-existent programs to optimized, resilient ones
• The program and people indicators that signal what stage your organization is really operating in
• Why many organizations get stuck in compliance-focused programs, and what’s required to move forward
• How to think about metrics, behaviors, and leadership alignment at each stage