Key takeaways
- A security behavior and culture program (SBCP) is an ongoing, organization-wide program that changes what employees do in a real-life cyberattack, rather than tracking only what they know.
- Leading global research group Gartner treats the SBCP as a key step in the evolution from security awareness to AI-driven secure behavior management (SBM).
- People are still the biggest attack surface in cybersecurity: 62% of breaches involve the human element (Verizon DBIR 2026).
- Knowing the rules isn't enough. 65% of employees report bypassing known security guidance for the sake of speed and convenience.
- An SBCP is a continuous cycle: assess behaviors, teach in small doses, reinforce through habits, measure real actions.
- Most organizations are still stuck thinking in terms of classic awareness training. In a 2023 Gartner Peer Community survey, only 13% had a fully operational SBCP.
- Short, frequent lessons delivered where people already work deliver greater long-term impacts than annual courses that are forgotten within days, especially as part of an AI-driven behavior management strategy.
Why security awareness training isn’t enough
Here’s a familiar scenario: An employee finishes their annual cybersecurity training with top marks. Three months later, they approve a fake invoice, or tap "approve" on an MFA prompt they didn't trigger.
How did this happen to a top student? Wasn’t their security awareness training enough to avoid this? It’s a scenario that plays out every day in organizations worldwide, and it isn't a knowledge problem. It's a habit problem, and habits break under pressure.
And the security industry is sitting up and taking notice. Analysts are now discussing the need to move beyond "awareness" to "behavior and culture", and the need for a security behavior and culture program (SBCP) sits at the center of that shift.
In this guide, we’ll cover:
- A clear definition of what an SBCP is, and how it differs from traditional awareness training
- A four-stage breakdown of how it works
- The behavior metrics that prove your SBCP is working
- A 90-day plan to get you started
This article is for CISOs, IT managers, and security leaders who already run training and want it to change outcomes, and for the CEOs, managers, and decision-makers who need to understand why the old approach keeps failing to keep their teams secure.
Let’s start with the basics.
What is a security behavior and culture program?
A security behavior and culture program (SBCP) is a continuous, organization-wide approach to reducing human cyber risk.
It uses behavioral science, regular practice, and measurement to make secure actions the default way people work, rather than something they think about only once a year.
Origins of the term
Gartner coined the term SBCP to describe the evolution of how organizations approach security awareness. In its 2024 Top Cybersecurity Trends, Gartner reported that organizations running SBCPs saw better adoption of security controls, less insecure behavior, and faster, more agile work.
Future predictions
Gartner has predicted that organizations could see 40% fewer employee-driven cybersecurity incidents as a result of combining AI tools with an integrated platform-based SBCP. In other words, behavior programs are now judged on the incidents they prevent, not the courses people complete.
What do we mean by security, behavior, and culture?
- Security: the risks in scope, such as phishing, credential handling, data sharing, AI tool use, and physical security.
- Behavior: specific, observable actions, like reporting a suspicious email, locking a screen, or checking a payment request by phone.
- Culture: the shared norms that decide what people do when nobody is checking, including whether it feels safe to report a mistake.
An SBCP is bigger than any one course or tool
An SBCP is bigger than a single course or phishing test. Those are tools an SBCP can use, but the program is the system that connects them, sets goals, and tracks change over time.
It also helps you make the business case. An SBCP supports NIST CSF 2.0's awareness and training category (PR.AT) and its organizational context controls. It supports ISO 27001 control A.6.3 (awareness, education and training) and SOC 2 training requirements too, which makes the budget easier to justify.
Let’s look at the biggest differences between SBCP and security awareness training.
SBCP vs security awareness training: what's the difference?
The core shift: Security awareness training asks, "Do people know the risk?" While an SBCP asks, "Do people actually act differently when facing the risk in reality?" This fundamental shift forces us to interrogate how people make decisions in the event of a high-stress, high-stakes cyberattack, and adjust how we support our teams accordingly.
Why the old model stalls: People don't often break the rules by accident. There is always a reason motivating people’s choice to ignore what they have learned and take shortcuts.
To support this, a CyberArk study found that 65% of employees had bypassed their organization's cybersecurity guidance over 12 months, mostly to deliver on deadlines and avoid cumbersome processes. They knew the rules and broke them anyway, because of pressures that surpassed what they had learned about security risks.
What research on annual training reveals: A large study at UC San Diego Health in 2025, followed more than 19,500 employees across ten simulated phishing campaigns. It found no meaningful link between completing a one-off annual training and clicking less on phishing emails, and only a very small benefit from "embedded" training after a click. The lesson isn't that training is useless, but that one-off training doesn't hold unless it's part of a more comprehensive long-term strategy to build lasting habits.
Classic awareness training vs. an SBCP
Here's an overview of how a Security Behavior and Culture Program differs from classic awareness training.
Goal
- Classic awareness: knowledge and compliance
- SBCP: lasting change in actions and norms
Cadence
- Classic awareness: an annual or quarterly course
- SBCP: continuous, with weekly or even daily touchpoints
Format
- Classic awareness: 30 to 60 minute modules
- SBCP: short lessons, nudges, simulations and feedback
Delivery
- Classic awareness: a separate LMS
- SBCP: the tools people already use (Slack, Teams, Google Chat)
Main metric
- Classic awareness: completion rate
- SBCP: reporting rate, click rate, time to report, repeat behavior
Ownership
- Classic awareness: the security or compliance team
- SBCP: shared between security, managers, and leadership
Tone
- Classic awareness: rules and warnings
- SBCP: support, no blame, positive reinforcement
SBCP vs human risk management
Human risk management (HRM) is the broader discipline of identifying and reducing people-related risk, often using data from security tools. An SBCP is the program inside it that's aimed at changing behavior.
An SBCP doesn't replace awareness training. It turns training from a one-off event into the first step of an ongoing, measurable cycle.
Learn more: A Culture of Cybersecurity Awareness Helps Manage Risk and Boost Your ROI – Here's How
How does a security behavior and culture program work?
An SBCP runs on a loop, not a one-time project. Each cycle focuses on a few target behaviors, builds them, checks whether they’ve stuck, and adjusts. Then it starts again, a little smarter – and more targeted – each time.
Here’s what this looks like across 4 key steps:
1. Assess: pick the behaviors that matter
Start from real incidents and risks, not a generic syllabus. Think wire-fraud attempts, password reuse, or unsanctioned AI tools.
- Set a baseline with your current phishing click and report rates.
- Add a short culture survey asking whether people feel safe reporting mistakes.
2. Educate: teach in small, relevant doses
- Keep lessons short, engaging, and linked to one behavior at a time. Tailor them by role, because finance, engineering, and executives face different lures.
- Introduce training into their regular work schedule, so training doesn't compete with their lunchtime.
3. Reinforce: turn knowledge into a habit
This is the stage most programs skip, and one of the most important.
- Practice: run realistic phishing simulations with instant feedback at the moment of failure.
- Guide people at the right moment: remind people at the moment of risk, such as before sharing a file externally.
- Recognition: reward reporting, so the right action feels supported, not punished.
4. Measure: track actions, then adjust
Look at behavior metrics, not just completion rates (more on those below) – then feed the results into the next cycle. Retire the behaviors that have stuck and add new ones as threats change.
A basic SBCP framework
Gartner's PIPE framework describes what an SBCP needs around it:
- Practices: the methods used to change behavior.
- Influences: the people and messages that shape it, such as managers, peers, and leadership.
- Platforms: the tools that deliver and measure it.
- Enablers: budget, executive sponsorship, and the right skills on the team.
Reduce friction first
If the secure path is slower than the insecure one, people route around it. Fix the process first, with password managers, SSO, and one-click reporting, before you ask people to try harder.
Why habits, not courses, make an SBCP work
A good SBCP builds lasting habits instead of delivering annual courses and hoping for the best. Three findings from psychology explain why that matters so much today:
1. We forget most of what we learn, fast
In the 1880s, Hermann Ebbinghaus discovered that without regular review, new information fades within days. If you run cybersecurity awareness courses once a year, that gives employees twelve months to forget what they’ve learned.
The alternative to this is the spacing effect. This method requires the same amount of study, spread across many short sessions, and results in information being remembered more effectively than one long session.
For security teams, the practical takeaway from these findings is: short lessons (three to five minutes) spread over weeks and months beat a single 30-minute annual course for the same time commitment.
2. Habits take weeks of repetition, not one session
There is no quick-fix hack to long-term behavioral change. A University College London study of 96 volunteers found that a new daily behavior took 66 days on average to become automatic, with a range of 18 to 254 days.
This is a great reminder that consistency over time matters more than perfection, and fits a weekly or monthly lesson rhythm far better than a yearly one.
3. What this looks like in practice
- Daily: gentle reminders and recognition, such as a warning before a high-risk action or a thank-you for a report.
- Weekly: a micro-lesson of two to five minutes on one behavior, delivered in Slack, Teams, or Google Chat.
- Monthly or quarterly: a phishing simulation, with coaching straight after a click.
- Continuous: topics refreshed as threats change, from deepfakes and quishing to AI vishing and more.
Habits like this can really pay off. Lastminute.com ran 24 micro-trainings a year, each five to ten minutes long, plus quarterly simulations across 1,700 employees. Within 12 months, its phishing vulnerability index dropped by over 50%.
How to measure a security behavior and culture program
Completion rates tell you who clicked "next", or who waited around long enough for a training video to be over. They don't tell you who changed: who stopped and looked closer at a suspicious email, who switched on 2FA, or who started using a password manager.
To prove an SBCP works, you need to measure what people actually do.
The metrics that matter
- Phishing report rate: Do people act by reporting incidents, or are they too afraid?
- Time to report: How long does it take for the security team to hear about a threat?
- Simulation click rate: Accurately exposes susceptibility to realistic lures.
- Repeat clickers: Reveals if coaching works on those at higher risk of falling for cyberattacks.
- Lesson engagement over time: Shows if a habit sticks longer than the first month.
- Policy exceptions and workarounds: Identifies where controls create friction.
- Culture survey score: Exposes if people feel safe reporting mistakes.
How to read the numbers
- Mix leading and lagging indicators. Report rate and engagement move within weeks. Incident counts take months. Show both to leadership so early progress is visible.
- Segment the data by team, role, and region. Averages hide the finance team that clicks twice as often.
- Report a trend, not a snapshot. Use a monthly dashboard with a 90-day baseline, and tie results to real incidents avoided where possible.
- Beware vanity metrics. A 0% click rate usually means the simulations are too easy, not that the risk has gone.
While we’re on the topic of crucial metrics, take a minute to read our free checklist on 12 essential cybersecurity metrics.
Your first 90 days
You don't need to get your SBCP perfect from day one. Here's a basic plan:
- Days 1 to 30, assess: Pick two or three target behaviors from your real incidents. Capture a baseline for click rate, report rate, and culture.
- Days 31 to 60, educate and reinforce: Start weekly micro-lessons in the chat tool your team already uses. Run a first phishing simulation with coaching straight after.
- Days 61 to 90, measure and adjust: Build a dashboard, compare it with your baseline, and share the early wins with leadership. Then choose the next behaviors for cycle two.
Next stop for SBCP? Secure behavior management
So, that’s an overview of what SBCP is, and what it means for driving impactful long-term security for every one of your teams. But where is SBCP going next? Secure behavior management (SBM) holds the key.
Gartner describes SBM as the next stage in the evolution from security awareness: rather than running the same campaign for everyone, programs use AI and behavioral data to work out who needs which nudge, and when.
In practice, that means lessons adapt to each person’s role and recent actions, coaching arrives at the moment of risk instead of weeks later, and metrics update continuously instead of once a quarter. The core loop stays the same (assess, educate, reinforce, measure), but it runs faster and more personally.
But to create that loop, you need the right tools.
How Riot supports a security behavior and culture program
An SBCP needs a delivery engine that makes small, frequent practice effortless not just for employees, but for the security team too. That's where Riot comes in.
Ongoing training, not an annual event
Albert, Riot's security coach, delivers training continuously on a schedule you set, so learning never stops after onboarding. Topics cover the core SBCP behaviors: social engineering, passwords, privacy and GDPR, digital footprint, and real-life (IRL) security.
This training is part of a wider ESPM strategy too, one that proactively limits what we share online and how attackers can use it against us.
Micro-lessons in the flow of work
Lessons arrive as short conversations inside Slack, Microsoft Teams or Google Chat. There's no separate LMS to log into and no hour blocked out of the calendar. The conversational format asks people to answer and react, not just watch, which helps them remember.
Daily and weekly habits
A regular rhythm of short lessons builds the spaced repetition and consistency described above. It pairs with Riot's phishing simulations, so the reinforce stage is covered too: practice, followed by coaching in the moment.
Retention you can see
Real-time progress metrics show who is engaging and where knowledge is weak. Managers are notified when someone needs extra support, which makes security a shared team habit rather than a security-team chore.
An SBCP can make all the difference
Security culture is built in small moments, repeated often. An annual course can teach people the rules, but it can't build habits. An SBCP runs as a continuous loop instead: assess, educate, reinforce, measure, then repeat. Each cycle turns secure actions into the default way your team works.
The right delivery engine makes the loop sustainable. Short, frequent lessons inside Slack, Teams, or Google Chat, backed by simulations and behavior metrics, let you prove change to leadership without adding work for your employees or your security team.
Ready to build secure habits where your team already works? Chat to one of our experts to see how we can help.
FAQ
1. What is an SBCP, and what does it do? Security behavior and culture program (SBCP) is a term coined by Gartner that describes a continuous program that turns secure behavior into routine by combining behavioral science, regular practice, and measurement.
2. Is an SBCP the same as security awareness training? No. Awareness training is one part of an SBCP. An SBCP adds reinforcement, culture, and measurement of real behavior.
3. How long does it take to see results with an SBCP? Leading indicators like report rate often move within a few weeks. Lasting habits take longer: research suggests around two months of regular repetition for a single behavior.
4. How often should employees get security training? Short sessions weekly, or at least every two weeks, plus regular simulations. This works better for learner retention than a one-off annual course.
5. Do small companies need an SBCP? Yes, but at a lighter scale. Smaller teams often move faster because culture is easier to shape.
6. What should an SBCP measure? Report rate, time to report, click rate, repeat clickers, engagement over time, and culture survey results.
