The staffing gap nobody budgets for
Ask most organizations who runs security awareness and the answer is "we have someone." Look closer and that someone is a security analyst, an IT manager, or a compliance lead spending 10 to 20 percent of their week on it. The SANS 2026 report puts a program that genuinely embeds culture at 4.3 full-time equivalents or more, and finds it takes at least 3 before behavior moves at all. The distance between those two numbers is the reason so many programs do the annual training, run a few phishing tests, and then plateau.
How the estimate works
The model starts with a baseline that rises with ambition: a developing program needs less dedicated staff than one chasing behavior change and measurement. It then adds a scaling factor tied to headcount, because a program covering 5,000 people is a different job than one covering 500. The numbers are calibrated so a mature program at a mid-to-large organization lands near the SANS 2026 benchmark of 4.3. It is guidance to frame a staffing conversation, not a precise headcount order.
Why under-staffing shows up as a year-two plateau
A fraction of one person can sustain compliance. It cannot simultaneously build engagement, run real assessment, and mature strategy. So the program does the part that fits the time available, which is usually training delivery, and the rest quietly never happens. The plateau is not a motivation problem. It is a capacity problem wearing a motivation costume.
When you can't hire, buy leverage
Most teams cannot close this gap with headcount. The realistic move is leverage: concentrate effort where risk concentrates, since roughly 10 percent of users drive 90 percent of incidents; automate delivery; and use a maturity model to spend your limited hours on the few moves that reduce the most risk. That is the difference between a busy program and an effective one.