Security Champions Programs That Don't Fizzle Out
Security champions programs almost always launch well — volunteers sign up, there’s a kickoff meeting, enthusiasm is genuinely high. Then within two quarters, champions stop showing up to the monthly sync, the security team stops preparing content for it, and the program quietly becomes a Slack channel nobody posts in. The failure pattern is consistent enough across companies that it’s worth designing around from day one.
Give champions authority, not just information
Most programs are structured as a one-way information pipe: security team teaches champions about threats, champions are supposed to relay it to their teams. This makes champions a newsletter forwarding service with extra steps, and that role doesn’t sustain motivation. Champions who instead get real authority — reviewing their own team’s threat models, having a say in which security debt gets prioritized on their team’s roadmap — have a reason to stay engaged, because the role does something rather than just knows something.
Make the time investment visible to managers
Champions almost always take on the role on top of their regular workload, with no adjustment to their sprint capacity or performance goals. When crunch time hits, the champion work is the first thing to slip, invisibly, because no one but the champion notices. Get explicit buy-in from engineering managers that champion time (even just 2-3 hours a month) is accounted for in planning, not absorbed silently — this single change predicts program longevity better than almost anything else.
Rotate the content, not just the people
Programs that repeat the same “here’s this quarter’s OWASP Top 10 refresher” format burn out fast because champions stop learning anything new. Mix in things champions can’t get elsewhere: a walkthrough of an actual internal incident, a live threat-model session on a real upcoming feature, or a chance to red-team a teammate’s design. Content that’s specific to your company’s actual systems is what keeps a champions program from feeling like a recurring training module people tolerate rather than value.