SANS 2026 Security Awareness & Culture Report

What is the SANS Security Awareness Report?

The SANS Security Awareness & Culture Report® has tracked the human side of cybersecurity for eleven years. The 2026 edition is the most expansive yet, drawing on responses from over 1,700 security awareness practitioners from around the world to identify and benchmark how organizations are managing their human risk.  

Built for practitioners at every stage, the report delivers the benchmarks and actionable guidance needed to mature your program, make the case for investment, and drive real change.

In this download you will find: 

• Program maturity benchmarks — where programs stand in 2026 by maturity stage, team size, and program age, measured against the updated Security Awareness & Culture Maturity Model™
• AI risk guidance— dedicated coverage on GenAI misuse, Vibe Coding, and Agentic AI, grounded in what practitioners are experiencing right now
• Resourcing data — how many FTEs it takes to shift behavior and embed a security culture by organization size and maturity stage
• Compensation and career development — global average salary, regional and industry breakdowns, and career pathways for practitioners at every stage
• 4,500+ open-ended practitioner insights — the most direct community voice in the report's history, covering what is working, what is not, and what surprised practitioners
• The new SANS Security Awareness and Culture Maturity Assessment — benchmark your program in real time against 1,700+ global peers and identify your next step

Get the Report →