Nadia’s password reset code went to an email she hadn’t opened in years. The backup text went to a number she no longer owned.

The November OUCH! Newsletter covers the six steps she wishes she’d taken first 🔐 go.sans.org/rgWG4Y

#SecurityAwareness #Passwords

“Don’t start with content, start with the people.” James Mountford, Security Awareness & Culture Lead at AVEVA, on the 2026 SANS Security Awareness Report.

Read the full report → go.sans.org/imaYcs

#SecurityAwareness #SecurityCulture

Lost your phone for even a minute and felt that panic? Emma lost hers on vacation for good. 📱

This month's OUCH! Newsletter breaks down:
✔ The setting that saved her
✔ What to check before your next trip

go.sans.org/IjaqYs

#CybersecurityAwarenessMonth

GenAI, Vibe Coding, Agentic AI. The risk isn't the tools. It's the moment employees stop checking their output. Find out what the 2026 SANS Security Awareness & Culture Report says about it: go.sans.org/imaYcs

#SecurityAwareness #HumanRisk

The longer you guess where your program sits on the maturity curve, the longer you're prioritizing blind. Get the answer now with the SANS Security Awareness & Culture Maturity Assessment:go.sans.org/imaYcs

#SecurityAwareness #HumanRisk

Employees are exploring new ways to use AI faster than many security programs can set clear guidelines. See what the most prepared organizations are doing differently. Get your copy: go.sans.org/imaYcs

#SecurityAwareness #HumanRisk

Stop guessing which training to buy. ASAP shows exactly where the gaps are. go.sans.org/XTQoEC

"Trained" and "secure" aren't the same thing. Hannah Hardee with @SouthwestArilines explains the gap — live in 1 hour.

Find out what closes it → go.sans.org/LDvKvg

#SecurityAwareness #HumanRisk

A café, a vacation, a phone left behind. Whoever found it could reach her email, banking, and boarding passes.

What saved her: two settings turned on before the trip.

🔒It's #CybersecurityAwarenessMonth. This month's newsletter has all five:
go.sans.org/IjaqYs

Royal Roads University's Don Devenney, SANS Security Awareness & Culture Report's Advisory Board, just finished the 2026 report. His pick for the standout section: the five open-ended questions.

Download the full report here: go.sans.org/imaYcs

Royal Roads University's Don Devenney, SANS Security Awareness & Culture Report's Advisory Board, just finished the 2026 report. His pick for the standout section: the five open-ended questions.

Download the full report here: go.sans.org/imaYcs

Completion rates don't measure culture change.

Hannah Hardee with @SouthwestAirlines, like many practitioners, are rethinking what security awareness means for an org — and sits down with Rachael Saffer to unpack it.

See how she's redefining the role → go.sans.org/LDvKvg

"Effective security starts with understanding people." Dr. Hassan Abutair, Founder & CEO of DIGISEC, on what's changing in security awareness programs. From the SANS Security Awareness Report 2026: go.sans.org/imaYcs

#SecurityAwareness #HumanRisk

Benchmark your program. Build the case for it. Drive real change. That's what over a decade of security awareness data gets you.

Get your copy of the 2026 SANS Security Awareness & Culture Report:
go.sans.org/imaYcs

#SecurityAwareness #HumanRisk

Get into someone's email and you can get into almost everything else they own.

MFA is what stands in the way. Five minutes now beats days of cleanup later.

go.sans.org/jEkgh7

#MFA

Your employees aren't your weakest link. New SANS data on why the strongest programs stop treating people as the problem and start designing security around how they work.

→ Watch the deep dive: go.sans.org/7S7IzH
→ Download the report: go.sans.org/imaYcs

"Your job isn't to educate humans on security — it's to educate the security team on humans."

New from @lspitzner: what comes after behavior change? → go.sans.org/Liuvs2

#SecurityAwareness #HumanRisk #SecurityCulture

The technology has changed. So has the job. The 2026 SANS Security Awareness & Culture Report breaks down what that shift means for practitioners.

go.sans.org/imaYcs

#SecurityAwareness #HumanRisk

Same phishing text. Same stolen password. One sibling got locked out of every account he owns. The other blocked the attacker cold.

The difference was MFA.

This month's OUCH! Newsletter: go.sans.org/jEkgh7 🔐

#SecurityAwareness #MFA

AI just earned its own section in the SANS 2026 Security Awareness & Culture Report and today at 11am EDT @lspitzner and Rachael Saffer unpack what drove the shift and what 1,700+ practitioners revealed.

Still time to join → go.sans.org/7S7IzH