A look at cybersecurity awareness and human defenses from the perspective of a CEO and board member. Part 2/2. Read part 1 here.
When boards discuss cybersecurity, we are forced to spend a lot of time on technology: SOC capabilities, endpoint protection, identity, cloud security, resilience, incident response and increasingly AI. Sometimes it is annoying but it makes sense, because these are major investments and major sources of operational risk. When it comes to risk, the 2026 SANS Security Awareness & Culture Report contains one number that, from a CEO and board perspective, I find surprisingly useful as a management indicator, a kind of cybersecurity staffing ratio: as a starting point, SANS recommends at least one human-focused security professional for every ten technical security professionals.
There are two additional figures worth putting beside it:
Source: SANS Security Awareness & Culture Report 2026
I would not turn these numbers into another compliance ratio, and SANS itself warns that staffing does not scale linearly with company size. But I do think they are useful for boards because they expose something that budgets sometimes hide: how seriously does the organisation actually take the human side of cybersecurity?
Your organisation chart reveals your real security strategy
Imagine a company with 40 or 50 people working in cybersecurity. There may be specialists for SOC operations, IAM, cloud security, vulnerability management, architecture, threat intelligence and incident response — and then one person responsible for awareness.
That one person may be expected to run training, simulations, communications and reporting; understand current attack methods; work with HR and Communications; explain results to management; collaborate with the SOC; and, somewhere between all of that, create a security culture.
From a management perspective, I find the imbalance more interesting than the precise ratio. SANS uses a very similar example: a 50-person security team with 49 people focused on technology and one person focused on the human risk side. I looked at the numbers behind this in more detail in 8 Hard Truths About Security Awareness Team Size.
Nobody would seriously suggest reducing technical security. The question is whether our organisational design still reflects today’s AI-enabled threat environment. Social engineering remains the leading human risk in the SANS report, the criminals are supercharged with AI in quality and speed of these attacks, and employees are often the people who first encounter the unusual email, phone call, Teams message or business request that has passed through the technical defenses.
If we say that employees are part of the defense, there should probably also be enough people whose job it is to make that statement operational.
This is a board issue, not an awareness-team issue
For me, this is where the topic moves beyond the CISO.
A board normally does not decide which phishing template should be used next month. Nor should it. But boards do make decisions about organisational capabilities, resources, reporting lines and management priorities. If the company says that human behavior is a material part of cyber risk, then it is reasonable to ask whether the organisation has built sufficient capability around that risk.
This also changes how we should think about the awareness role itself. The awareness professional is not simply a training administrator. In a mature setup, this person has to connect very different worlds: the workforce, the SOC, management, HR, Communications and sometimes Legal or Compliance. They need enough security understanding to work with professional defenders (read: our SOC), but also enough communication, behavioral and business understanding to work with everybody else.
SANS makes this point repeatedly. Its career guidance describes awareness as a behaviour-change role operating in a security context and warns that highly technical specialists can struggle to communicate effectively with nontechnical audiences, because what appears obvious to an expert may not be obvious to the rest of the organisation.
This matters at board level too. If cyber risk is explained almost exclusively in technical language, leadership may hear a long list of technologies, vulnerabilities and controls without understanding what business problem is actually being solved. Human defenses need to be discussed in the language of operational risk, resilience, fraud, response speed and business continuity.
Or, as SANS puts it rather nicely elsewhere: people follow people, not policies.
The Berlin hack is a useful example
Our recent article about the Berlin administration attack made me think about this again. The initial compromise used TerminalFix, a ClickFix variant in which a manipulated website persuaded a user to follow what looked like a legitimate IT process and paste a command into the terminal. The decisive step was therefore not some exotic exploit, but a human being following a plausible instruction.
The management lesson, in my view, is not simply that employees need “more awareness”. The more useful questions are whether people have practised situations that resemble real attacks, whether they know how to react when something feels unusual, and whether reporting is simple and close enough to the SOC that an employee observation can become a useful security signal.
This is also why I would be careful about immediately equating maturity with the fanciest simulation technology. Vishing, smishing, deepfakes and connected multi-channel exercises absolutely have their place, especially as AI changes social engineering. But an organisation that has not yet established good personalised phishing exercises, simple reporting, meaningful feedback and a trusted relationship between employees and security probably has more basic work to do first.
The technology should follow the maturity of the organisation, not compensate for its absence.
Why three or four people suddenly do not sound excessive
At first glance, three awareness FTEs for behavior change or more than four for culture may sound like a lot. It sounds very different once we stop assuming that their main job is operating an awareness platform.
Someone has to understand what the SOC is seeing and translate that into exercises. Someone has to understand how Finance, HR, developers or executive assistants actually work. Someone has to build relationships across departments and communicate with leadership. Someone has to analyse behavior, reporting and feedback rather than simply completion rates. And somebody has to make sure that an employee who reports something suspicious actually experiences that reporting as worthwhile.
Modern technology and AI can reduce a huge amount of repetitive and quantitative work around awareness. But that does not mean campaigns themselves should simply be delegated to a generic full-service provider or run as standardized automation. Effective campaigns need context: the context of the company, the employee, the role, the current threat situation and the behaviors you actually want to influence. That is exactly where the awareness professional remains essential. Technology should give that person more capacity to create better, more personalized and more relevant interventions, not remove them from the process.
That distinction is important for CEOs and boards. Automation can make a small team dramatically more effective, but it does not make the organisational capability unnecessary.
Perhaps the board should ask one additional cyber question
Boards already ask CISOs about incidents, vulnerabilities, risk exposure, resilience and security investment. I think there is room for one additional question:
There is no universally correct number. A highly regulated global company and a 1,000-person industrial business clearly have different needs, and SANS explicitly says that organisation size alone does not provide a simple staffing formula.
But the answer tells management something important about how the company thinks about cyber defense.
If 49 people protect the technology and one person is expected to take care of everybody else, the problem may not be that this one person needs to work harder or buy another tool. The more fundamental question is whether the organisation has invested in the human side of defense with the same seriousness with which it has built the technical one.
That is ultimately why I like the SANS ratio. It does not give the board a perfect staffing formula, but it provides a very simple mirror.
If humans are part of the defense, human defense needs organisational capacity too.
Have more than 1 out of 10 heads in your security team dedicated to human defenses.
So Long, Palo Stacho
Palo Stacho is CEO of CYBERDISE and a cybersecurity entrepreneur with 30 years of industry experience. He is also a board member, scale-up trainer and speaker. He lives with his family in Switzerland.
PS: AI in awareness. Want to discover where AI really makes sense in awareness, and how AI-enabled spearphishing exercises led to ~60% better risk behavior? Read our study with the Lucerne University of Applied Sciences (HSLU).
