AI is the second-biggest risk to people in the workplace

The Sans Institute’s «Security Awareness & Culture Report 2026» is now in its eleventh edition and is considered the only annual benchmark produced by and for security awareness professionals. The survey is based on responses from more than 1,700 security awareness professionals from North America, Europe, Asia, Africa, Australia, and South America. The results were reviewed by a newly formed 12-member advisory board, which includes experts from the Bank of Ireland, Medibank, and Datadog.

AI Is Rapidly Climbing the Risk Rankings

Two years ago, artificial intelligence still ranked fourth among the human risks identified by security awareness experts. Today, according to the latest report, it ranks just behind social engineering. The report devotes a separate section to AI-related risk trends and identifies three areas that experts must actively manage today: the unauthorized use of generative AI tools by employees, so-called «vibe coding» by individuals without a software development background, and risks posed by AI agents whose actions are not reviewed by humans.

The data also shows that 75 percent of security awareness teams are already using AI to develop and manage their own programs. Only 2.4 percent have tried AI and decided that it is not useful.

Staffing remains a critical bottleneck

Despite rising salaries across the industry, most cybersecurity awareness programs lack the staff needed to go beyond basic compliance training. The report makes it clear: A program’s maturity depends more than anything else on two variables—team size and time.

To bring about lasting change in the workforce’s behavior, at least three dedicated employees are needed, and it takes three to five years for results to become apparent. For the next phase—building a lasting safety culture—a larger team of just over four dedicated employees is needed, along with a timeframe of five to ten years. Most of the programs studied do not meet either of these two thresholds.

Rising Salaries, New Benchmarking Tool

The global average salary for professionals in the field of security awareness reached $123,624 in 2026—an increase of approximately $7,000 from the previous year. The European average was $106,896. The report further breaks down the salary data by region, industry, and professional background.

The report now also includes an interactive benchmarking tool that allows professionals to compare their program's maturity, team size, and resource allocation in real time with the entire dataset.

«Every year we hear the same thing from experts: They know where their program stands, but they’re not sure what to do next. Which actions will have the greatest impact, especially given limited time and budgets? We wanted to bridge that gap with this issue,» says Lance Spitzner, Technical Director at Sans Workforce Security and Risk Training. «We’ve updated the metrics matrix to better align it with the maturity model, so that professionals receive concrete actions tailored to the actual status of their program. This data provides them with tangible arguments for budget discussions with senior management.»

Source: www.sans.org

This article originally appeared on m-q.ch - https://www.m-q.ch/de/ki-ist-das-zweitgroesste-risiko-fuer-menschen-am-arbeitsplatz/