The model
Culture as a service: what it is and when it makes sense.
The definition in one sentence, the research behind the model and what changes for companies that handle everything with one course a year.
What is culture as a service?
noun phrase1. Culture as a service is an ongoing model in which a specialist partner plans, produces content for, operates and measures programs that turn company policies into everyday behavior. It uses games, missions, team competitions and internal champions, with the platform included, across topics such as information security, compliance, privacy, respect and workplace mental health.
e.g. Instead of one course a year, the company subscribed to culture as a service: missions throughout the year, run by qlture.
Not to be confused with “service culture” (customer service focus) or with “Culture-as-a-Service” used for remote team engagement tools.
Why a service instead of a course
Why doesn’t knowing the rule
change the decision?
The strongest studies of recent years agree on one point: knowing the rule does little to change what people do. And culture takes years, dedicated people and a lot of repetition to shift.
19.5k
employees in a UC San Diego randomized study: recent annual training showed no relationship with clicking less on phishing.
IEEE S&P 2025, UC San Diego ↗96%
of people who took a risky action knew it was risky.
Proofpoint, State of the Phish 2024 ↗3
dedicated people, at least, and 3 to 5 years: that is what SANS estimates it takes to change behavior. Lasting culture takes just over 4 people and 5 to 10 years.
SANS Security Awareness & Culture Report 2026 ↗6 to 12
months is what the SANS maturity model indicates for measurable change when a program focuses on a few high-impact behaviors.
SANS Security Awareness and Culture Maturity Model ↗Written values are not enough either: an MIT Sloan study of 1.2 million reviews found no correlation between companies’ official values and employees’ actual experience. MIT Sloan Management Review, Culture 500 ↗
How the model works
What does an ongoing program do
that a course does not?
- 01
A program built in cycles
Each cycle has its own topics, audiences, formats and goals, and learns from the last one.
- 02
Someone runs it for you
qlture plans, produces the content, runs the campaigns, manages the platform and tracks the numbers. Your team decides and validates.
- 03
People practice the decision
Short decision missions, team competitions and champions in every area. The right choice gets rehearsed before the real moment.
- 04
We measure what people choose
Participation counts, but we also track the decisions people make in missions and how they change from one cycle to the next.
Comparison
What is the difference between a course, a platform
and culture as a service?
| Criterion | Annual training | Self-service platform | Culture as a service |
|---|---|---|---|
| Rhythm | Once a year | Depends on who runs it | Continuous, recurring cycles |
| Content | Generic | Ready-made library | Built from your policies and situations |
| Who runs it | Your team | Your team | qlture, with your team |
| Format | Video and quiz | Modules and simulations | Missions, games, competitions and champions |
| Topics | One per course | Mostly security | Security, compliance, privacy, respect, wellbeing |
| What is measured | Completion | Clicks and completion | Participation, choices and progress |
Culture change program
How do you change organizational culture
on an ongoing basis?
A once-a-year event gives nobody the chance to practice. An ongoing culture change program picks a few behaviors, builds situations to practice them, runs missions and campaigns in cycles and measures what people choose. You can call it cultural transformation when those behaviors keep showing up in the months when no campaign is running.
Pick a few behaviors
Read the policies, listen to each area and define what people need to do differently in concrete work situations.
Write each one as a scene
A scene with a decision and what happens next, in each audience’s language and based on real cases from the company.
Keep it on the calendar
Short missions, campaigns and team competitions take turns during the year, while champions in each area answer day-to-day questions.
Measure and adjust
Track participation and choices by area to decide what to reinforce in the next cycle and which audience needs attention.
Where the term comes from
Why “as a service”?
The logic comes from software: instead of buying a license and running it yourself, you pay for the service up and running. Here, the service is a program that works on behavior.
The security market made a similar move: in 2024 Forrester renamed the category “human risk management”, shifting from training people to managing behavior.
In security, the same model is often called managed security awareness or security awareness as a service. qlture runs it that way for security and extends the same operation to compliance, privacy, harassment prevention and psychosocial risks.
The term “culture as a service” has been used before, with other meanings. For qlture it means one specific thing: an ongoing, operated program that turns policies into practice.
Forrester, 2024 ↗Frequently asked questions
01Is culture as a service the same as training?
No. Training is an event with a start and an end, usually a yearly course with a quiz and a certificate. With culture as a service, the program is ongoing, organized in cycles and run by qlture, and what gets measured is the choices people make. Mandatory training still happens, as one of the year’s moments.
02Is culture as a service a platform?
The platform is included, but it is not what you buy. With culture as a service, the company contracts the program: a yearly plan, content built from its own policies, campaign operations, participation tracking and adjustments every cycle. There is no other tool to license or run for the program to happen.
03How long until we see results?
Participation and the first changes in choices show up in the early cycles. In the SANS maturity model, focusing on a few high-impact behaviors brings measurable change in 6 to 12 months. For the whole organization, the SANS 2026 report talks about 3 to 5 years for behavior and 5 to 10 for culture.
04Which topics fit culture as a service?
Any topic with a written rule and a daily decision that tests it: security awareness, compliance and ethics, privacy and data protection, harassment prevention and psychosocial risks. Company values fit too, even without a law behind them, when they need to show up in the decisions people make every day.
05What does the company need to do?
The company sets priorities, shares its policies and real situations from daily work, approves content before it goes live and follows the results of each cycle. Planning, production, campaign operations and measurement stay with qlture, along with the platform.
06Can we start small?
Yes. You can start with one topic and one audience, such as security awareness for finance or harassment prevention for managers, and grow as results show up. The design changes with company size, and new topics and teams join in the following cycles.
07When does culture as a service make sense?
It makes sense when the company knows what needs to change but lacks the people to keep it moving: there is a legal duty of periodic training and only a yearly course to show, human risk is relevant, or several areas compete for the same people’s attention. A mature in-house team with time may only need a platform.
Want to see the model
applied to your company?
We will show you what the first cycle of your program could look like.
Let’s talk