How to Scale Security Awareness With Ambassadors

TL;DR

Security ambassadors scale human-risk management by placing trusted volunteers across departments, regions, and specialist groups. These peers can engage coworkers more effectively, provide local information, and extend a part-time awareness officer’s reach. The program should focus on sustained behavioral change, because visible results can gradually influence security beliefs, attitudes, perceptions, and organizational culture.

Transcript

As mentioned, my name is Lance Spitzner. I'm a director at SANS Security Awareness, part of the SANS Institute. So my job and passion is traveling the world, helping organizations build mature awareness programs, i.e, manage human risk. I've been doing this for about 10 years now. I've worked in over 30 countries with hundreds of awareness programs... Read More

Key Insights

• Security awareness is a control for managing human risk, just as antivirus and firewalls are controls for addressing other security risks. Programs lose direction when they focus on activities without remembering that their central purpose is to reduce risk associated with human behavior.
• Awareness-program maturity extends from compliance toward behavioral change, cultural change, and measurable results. Metrics are relevant at every stage, but a program cannot be considered fully mature until it can demonstrate that behavior and culture have changed.
• Annual compliance training is designed primarily to satisfy requirements, not to transform human behavior. Moving beyond that stage involves repeated activities such as phishing exercises, computer-based training, lunch-and-learn sessions, podcasts, infographics, fact sheets, and other forms of continuing engagement.
• Security culture consists partly of people’s beliefs, attitudes, and perceptions about security. These internal elements are difficult to observe directly, so awareness teams must look at visible behaviors, statements, and other artifacts when assessing whether cultural change is beginning.
• Cultural change starts with sustained behavioral change, not with direct attempts to alter beliefs. When people experience the benefits of safer behavior, they may begin to believe in it, although significant and measurable organizational culture change can require three to ten years.
• Staffing is a major constraint on security awareness programs. More than eighty percent of surveyed awareness professionals spent fifty percent or less of their time on awareness, and only about seven percent were dedicated to it full time, limiting their capacity to reach entire organizations.
• Security ambassadors are volunteers embedded throughout an organization who assist the central awareness function. A distributed network can extend limited staff capacity across offices, regions, departments, and specialized audiences while giving the program access to local knowledge and feedback.
• Peer credibility makes ambassadors effective with specialized groups such as developers, doctors, lawyers, engineers, executives, help-desk personnel, and faculty. Ambassadors can communicate in familiar professional contexts, engage coworkers who may discount central messaging, and help work around organizational communication bottlenecks.

Questions & Answers

Q: What is a security awareness ambassador program?

A security awareness ambassador program is a network of volunteers embedded throughout an organization who assist the central awareness function. These volunteers may also be called champions, advocates, sentinels, or ninjas. Their placement across departments, offices, regions, and specialist communities helps a small awareness team extend its reach, communicate through trusted peers, and gather useful local information.

Q: How do security ambassadors help scale an awareness program?

Security ambassadors scale an awareness program by distributing support among volunteers across the organization. Instead of relying on one awareness professional, the organization can have many people helping in different offices, regions, and work groups. This structure is especially useful when the central professional works on awareness only part time and cannot comprehensively engage every audience alone.

Q: Why are peers effective security awareness messengers?

Peers can be more effective because some employees are more willing to listen to coworkers who understand their profession and daily work. The transcript specifically identifies developers, doctors, lawyers, engineers, executives, help-desk personnel, and faculty as distinct audiences. An ambassador within such a group can communicate with professional credibility that a central awareness officer may not possess.

Q: How does behavioral change influence security culture?

Security culture includes beliefs, attitudes, and perceptions, but those internal elements are difficult to see directly. The practical approach is to change behavior over the long term. When people observe that safer behavior produces useful results, they can begin to believe in it. Their actions, statements, and personal examples then become visible evidence that culture is shifting.

Q: How long can measurable security culture change take?

Behavior can begin changing within days or weeks, but significant and measurable change across an organization’s culture can take much longer. The presentation cites change-management findings that real cultural change may require three to ten years. Awareness leaders should therefore distinguish early behavioral improvements from deeper changes in employees’ lasting beliefs, attitudes, and perceptions about security.

Q: Why is annual compliance training insufficient for changing behavior?

Annual compliance training can help an organization satisfy requirements and check a compliance box, but the presentation describes this approach as ineffective for changing human behavior. Stronger programs add continuing engagement through phishing exercises, computer-based training, lunch-and-learn sessions, podcasts, infographics, fact sheets, and similar activities. Repeated behavioral reinforcement supports progress beyond basic compliance.

Q: What problems can a security ambassador program address?

An ambassador program addresses three major problems identified in the presentation: awareness professionals often lack enough dedicated time, mature programs must reach many different target groups and locations, and teams can run out of fresh engagement ideas. Embedded volunteers expand capacity, adapt outreach to local audiences, and feed information back to the central program.

Q: How can security ambassadors improve organizational communication?

Ambassadors can communicate directly within their existing teams and professional communities, reducing dependence on a central communications department that may slow awareness outreach. The goal is not to operate without organizational coordination, but to use trusted local volunteers as additional channels. Their embedded positions also create a feedback network that supplies the awareness team with information from across the organization.

Summary & Key Takeaways

• Security awareness is a control for managing human risk, comparable in purpose to technical controls such as antivirus and firewalls. A mature program progresses beyond annual compliance training toward changing behavior and culture. Metrics belong at every stage, but full maturity requires evidence that behavioral and cultural changes have actually occurred.

• Awareness teams face three recurring constraints: limited staff time, increasingly diverse target groups, and difficulty producing fresh activities. More than eighty percent of surveyed awareness professionals devoted half or less of their time to awareness, while only about seven percent worked on it full time. These conditions make organizational reach difficult.

• An ambassador program recruits volunteers embedded throughout the organization to support awareness work. Ambassadors extend the program into departments, offices, regions, and specialist communities. Because employees may trust knowledgeable peers more than a central awareness officer, ambassadors can improve engagement, bypass some communication bottlenecks, and return useful information from their local groups.