Leadership and security culture: What the data really shows

Leadership as the strongest indicator of maturity

The Security Awareness Radar measures "Leadership" as a distinct domain. The result of the evaluation shows that the domain “Leadership” has the greatest gap between insufficient and very good security culture after the domains “Training” and “Communication”.

TABLE

The table makes it clear: While knowledge is already relatively high at low maturity levels, the leadership function increases dramatically across the levels. Leadership is thus not an additional factor, but a key driver of safety culture.

The leadership gap in the middle of the hierarchy

An in-depth analysis of the hierarchical differences in ratings reveals a particularly relevant pattern. Team leaders (middle management) systematically rate the leadership of their direct supervisors more critically than other hierarchical levels rate their respective supervisors:

• Employees evaluate teamleaders: 46.1 points
• Teamleaders evaluate middle/upper management: 42.2 points (lowest value)
• Middle/upper management’s assessment of top leadership: 50.5 points

In 10 of the 12 cases examined, team leaders’ ratings are lower than those of upper management. This means that team leaders experience a “leadership gap” precisely where strategic security guidelines are translated into day-to-day operations. This interface is critical.

Leadership and perception—a two-way interplay

The data reveal another important correlation: Where leadership visibly supports, exemplifies, and prioritizes information security, the perception of security issues is also more pronounced. And conversely: Where leadership signals are absent or inconsistent, security remains marginal in employees’ perceptions—regardless of how much training has been completed.

Leadership is therefore not merely a multiplier for effective training. It is the decisive context in which training content either takes effect or fizzles out without impact.

Practical implications

What does this mean in practice? Taking safety culture seriously as a leadership responsibility means, specifically:

• Safety issues must be regularly on the agenda of leadership bodies—not just after incidents.
• Managers must actively and visibly discuss safety-related issues—in town hall meetings, team meetings, and employee reviews.
• Middle management needs explicit support and resources to integrate safety issues intoday-to-day operations.
• Safety incidents are used as learning opportunities—not as scandals to be forgotten as quickly as possible.

Conclusion: leadership is not optional—it is a duty

The data from 20 years of the Security Awareness Radar is unequivocal: a strong security culture emerges where leadership visibly prioritizes security. This is not a vague management principle, but an empirically proven fact. Organizations that ignore this will not break through the glass ceiling to cultural excellence—no matter how good their technical safeguards are.

You can request the full report on 20 years of SAR and the insights it provides HERE free of charge.