Security Champions: The What, Why, and How
summary
Proposes scaling security from about 1% to 10% of the engineering population by appointing one security champion per small team, each completing roughly 10–15 hours training (example vendor cost ~$250/user). Champions learn static and dynamic testing, CI/CD hardening and tools like Burp Suite, coordinate via Slack and bug trackers, and triage alerts so critical CSO overrides are handled within 1–3 days. A 12‑month pilot reaches 10% coverage, cuts false positives, surfaces previously unknown vulnerabilities, and increases early threat modeling.
AI-written summary · about
chapters (20)
- 0:00Intro
- 1:53COST OF A DATA BREACH
- 3:21OPEN SOURCE SOFTWARE?
- 4:37CLOUD NATIVE?
- 6:23SECURITY IS OFTEN NEGLECTED IN TRANSFORMATIONS
- 7:09WE NEED TO UP OUR GAME
- 7:41WHAT MOTIVATED US?
- 8:36LOG4SHELL VULNERABILITY
- 9:39WHY DO WE NEED
- 10:14WHAT ARE SECURITY
- 10:45SECURITY FOCAL SECURITY CHAMPION Security Focal
- 12:10STARTA SECURITY CHAMPIONS PROGRAM
- 13:18PROGRAM DESCRIPTION HIGHLIGHTS
- 17:24SECURE ENGINEERING GUILD
- 19:04COMMUNICATION CHANNELS
- 19:59GLOBAL TEAMS
- 20:56TRAINING FUNDING
- 21:54COMPLIANCE FATIGUE
- 23:19IBM DIGITAL
- 25:42KEY TAKE AWAYS
related talks
16mSecurity Champions The What, Why, and How
37mBuilding Security Champions
51mBuilding Security Champions
36mChampioning Security: Scaling Security at Every Level
32mSecurity Champions? Introduce them in your Organisation
35mSDL at Scale: Growing Security Champions
48mGrowing A Security Champion Program Into A Security Powerhouse
32mBeyond training: Building a high-impact security champions program