How to build a successful security champions program

Defining a security champion

A security champion is an employee who has been given an additional security role within their existing team. A champion is not a member of the security team; rather, they act as a point of contact between their team and the central security department. The goal is for champions to translate organization-wide security requirements into practical, easily digestible guidance that fits their team's actual workflows.

The security champion role is important because they already understand how their team works day-to-day, including which technologies are used, processes are followed and types of security problems they are likely to encounter.

A champion sits in on meetings, reviews the early design phase and participates in conversations where decisions are made. This enables the champion to identify security concerns early, rather than waiting until a project is complete. For example, a champion might question their team about how customer data is stored during a design discussion or point out that certain third-party libraries should undergo a security review before adoption.

As mentioned, a security champion is not a replacement for a security professional. They should not be expected to perform complex security tasks, investigate major incidents or make critical security decisions. The champion's role is to bring security into their team's normal decision-making process.

Who should be a security champion?

While security champion programs are commonly associated with software development and application security, organizations can extend the model to other functions where security decisions are regularly made, such as cloud, data, AI, product and other business operations.

Champion candidates include software developers, engineers, architects, DevOps, product owners, analysts, product managers or any other employee with a strong understanding of their team's inner workings.

Don't assume that the best candidate to become a champion is the most technical person. While a champion needs to understand security, they should also be able to communicate effectively with their colleagues and encourage the adoption of secure practices.

An ideal champion acts as the first point of contact for security questions, helps establish best practices and continually closes the gap between their team members and the central security department.

The main duties of a security champion

A security champion's tasks depend on the team's size, technology stack and security maturity. Common functions include the following:

• Promote security awareness. Champions ensure security is part of day-to-day team conversations. They share lessons learned from previous incidents, discuss new threats and suggest security practices to counter them. This makes security a shared habit, not something to think about after an incident occurs. For example, a champion might share a real phishing attack that targeted a colleague and how they successfully spotted it.
• Serve as point of contact. Champions are the first point of contact for security-related issues. They help identify security concerns and deliver relevant security requirements from the central security department to their teams. For example, a developer might ask their team's champion where to store the API keys for the software they are developing. The champion either explains how or, if they do not know, takes the question to the central security team.
• Support secure design and code review. Security champions identify errors early in the design process, before code is written and deployed into production. When meetings are held to discuss the design of a new system or feature, champions question how data will be stored, how different services will authenticate, what will happen if a user enters incorrect information and what the overall impact will be if something goes wrong.
• Help during triage and vulnerability management. Security telemetry accumulates quickly. Champions can help by turning the stream of alerts into something manageable. For example, champions can interpret data from security tools and pen testing exercises and present relevant information to their teams.
• Two-way communication. Security champions facilitate conversations between groups that do not regularly communicate directly: the security team, which focuses on risk and policy, and the development team, which focuses on delivery deadlines and technical design constraints. When the security department issues a new security policy, standard or requirement, champions explain to their team why the policy is required, what it means for the team and the direct effect on their day-to-day work. Teammates with questions about the new requirement can ask the champion directly instead of submitting a ticket to the security team or, worse, ignoring the policy entirely.

Ultimately, a security champion helps make security a part of their team's regular way of working rather than something added at the end of the project.

How to build a security champions program

Establishing a program requires more than asking each department to nominate a participant. The organization needs to clearly define the program's objectives, the champions' duties and how the central security team will support their work. Without clearly defining these aspects, the program will become another initiative that might not reach implementation.

Get executive and peer buy-in

Secure support from top management and the teams participating in the program. Executive support establishes the program's legitimacy and provides necessary resources, while peer support provides day-to-day cooperation, which is essential to the program's functioning.

Executive support is also key because champions need time to perform their duties. If managers expect champions to perform the additional tasks after business hours, it will affect participants' enthusiasm. Managers should endorse the champion program by allocating time for participants and viewing it as a valued initiative and business enabler rather than a compliance duty.

Determine the scope and goal

Clearly define the objectives of the champion program. Make goals specific and measurable. Simply stating that the program will "improve security culture" does not provide a clear sense of success and makes it difficult to determine the program's effectiveness.

Goals might include increasing participation in threat modeling or improving vulnerability remediation. Or perhaps an organization introducing more AI systems could use champions to identify shadow AI, discover data exposure risks and define other AI security requirements.

The program's scope should also define what champions are not responsible for. For example, while a champion might discover a security vulnerability, the central security team remains responsible for assessing its severity and business impact and determining the appropriate response.

Recruit members

The best candidates are not necessarily the most senior employees nor those with proven security knowledge. Ideal champions know how their teams work, maintain credibility with their colleagues and have a genuine interest in security.

For example, a senior architect might be a preferred candidate but have no time to take on the role. On the other hand, a junior developer could have a strong interest in security but lack influence when making important design decisions. The strong champion sits between these two examples: someone who is trusted by their peers, interested in improving security and willing to speak up when something looks risky.

The central security team should consider how much time champions can dedicate to the role. If the champion can't attend meetings, participate in security training or communicate with the security team, they will likely be ineffective. Discuss the requirements with the candidate and their manager, even if the role only requires a few hours per month.

Train the champions

Training is an important part of any champion program. Yet, a one-size-fits-all curriculum is ineffective because teams face different threats and have different workflows. If training is too broad, it's a waste of the champion's time; if it's too shallow, champions might be hesitant or unable to contribute confidently to team discussions.

Remember, the goal of a security champion network is not to turn champions into security experts, but to equip them with the knowledge to ask the right questions, spot common risks and know when to escalate an issue to the central security team.

Provide practical security resources, such as checklists and reporting procedures, and clearly explain who to contact when an issue is identified. Use a shared repository containing templates, examples and FAQs to help champions find the information they need. This can also reduce repetitive questions for the security team.

Implementation roadmap

Building a security champions network doesn't happen overnight. Give the security team time to recruit the right people, understand the support needed and measure whether the program produces useful results. A phased approach helps build a sustainable program and enables the security team to identify problems before they become embedded in a large organizational program.

Start with a pilot

Create a pilot with a few teams. Don't recruit too many champions until the security team understands how the program works. The pilot is a learning exercise that enables organizations to identify friction points, test assumptions and update the program design before dedicating the required resources.

For example, begin with champions from three teams: software development, AI and cloud infrastructure. As noted, each team has different security requirements: the development team is concerned with secure code review, the cloud team with identity management and misconfigurations, and the AI team with data protection, model and API security, and third-party tool risks. The mix of security needs across these teams enables the organization to identify issues early rather than after a broad launch.

The objective of the pilot is not to prove that the program works perfectly, but to identify what works, what does not and what needs to change or update before expanding it.

Establish a regular operating model

Once the pilot begins, establish a reliable way for champions to interact with the central security team. Without regular communication, the network can fragment, champions might work in isolation, questions can go unanswered and the security team can lose visibility into what's happening across the champions' teams.

Communication channels include a monthly champion meeting, periodic security email updates and a dedicated Slack or Teams channel where champions can ask questions and report concerns.

At this time, the central security team should establish a clear escalation process for issues that require direct assistance and specialized expertise.

Grow gradually

After the pilot, expand the program. Handle the expansion wisely; repeat what worked in the pilot and fix or avoid what failed.

Don't measure champion program growth by the number of champions recruited. Adding 40 champions who rarely communicate with the central security team or attend meetings won't provide more value than appointing 10 active champions who regularly participate in security activities. Focus on the quality and activity of the champion network rather than simply increasing its size.

As the program grows, monitor champions' participation, collect their feedback and adjust the program when necessary.

How to measure program success

Security teams need to evaluate whether the champion program improves overall security, adds value to the organization and produces measurable results.

Security metrics measure whether security risks are identified and managed more efficiently. For example, if the development team previously discovered security risks in the final project phase but now -- after launching the champion program -- identifies them during design reviews, this clearly indicates the champion program is having a positive effect.

Business metrics illustrate benefits in terms of reducing costs, friction and delays. Discovering security flaws early in the design phase, for example, reduces the amount of rework required before a system goes into production, thereby reducing costs associated with launch delays and late-stage remediation and increasing the speed of delivery cycles.

Using both sets of metrics provides a complete picture of the program's effectiveness and helps ensure management support to sustain the program.

When presenting to management and the board, emphasize the program's risk and business impacts rather than listing its operational details. Board members are more concerned with oversight and strategy than with how the program is run.

Use security and business metrics to report on how champions have improved security organization-wide, including how their involvement has reduced time to remediation. Also explain how the champion program did not operate efficiently or failed to achieve the expected results.

Common pitfalls of champion programs

While a security champion program can provide significant value to businesses, the following mistakes can reduce its effectiveness:

• Treating security champions as security experts. Champions cannot replace dedicated security professionals. Their main role is to identify and escalate security issues, not solve complex security problems.
• Not giving champions enough time. Don't treat the champion role as a full-time security position. Champions have their own job responsibilities, so ensure champion duties fit into their existing schedule. Forcing champions to work extra hours will lead to declining involvement and commitment in the program.
• Not clearly identifying champions' responsibilities. Ensure champions know exactly what they are expected to do and what they are responsible for. They should also know which issues they must solve themselves and which to escalate to the central security team.
• Asking champions to enforce security policies. The primary purpose of a champion is to assist their colleagues with security issues. Don't ask them to enforce company security policies, as this could undermine the trust necessary for them to function effectively in their teams.
• Not having enough support. Many organizations launch a champion program and then abandon it. Champions need continual training, collaboration and assistance from the central security team for the program to be successful.

Nihad A. Hassan is an independent cybersecurity consultant, digital forensics and cyber OSINT expert, online blogger and author with more than 15 years of experience in information security research. He has authored six books and numerous articles on information security. Nihad is highly involved in security training, education and motivation.