Championing Security: Scaling Security at Every Level
summary
Security teams run about 100 to 1 short, so the practical fix is empowering embedded security champions on every team who spot problems, ask the right questions, and liaise with central security. The program follows concrete guides like the OWASP Security Champions Guide and WeHackPurple, uses tools such as secret detection, SCA, honeytokens, Vault and cncf scorecard, rewards reporters with $25 monthly drawings or badges, counts contributions toward reviews, limits commitments (eg. 3–6 months), and automates celebrations with chatbots and AI.
AI-written summary · about
chapters (25)
- 0:00Introduction
- 1:03Leslie’s security struggle
- 4:12From frustration to empowerment
- 6:00Security’s shift to enabler
- 7:23Building security champions
- 8:47Three guides for champion programs
- 10:36Recruiting and engaging champions
- 11:42Champion programs need effort
- 12:44Passion for security transformation
- 14:09Start with vision and goals
- 15:55Speaking risk and management language
- 17:23Win-win security solutions
- 18:04Team effort and skills
- 19:30Trusting and empowering champions
- 20:36Active listening and feedback
- 22:03Building security community
- 23:27Two-way communication
- 24:30Celebrating small wins
- 26:14Knowledge sharing and news
- 28:00Rewarding champions
- 29:25Investing in people
- 31:12Sustainable champion programs
- 32:35AI and gamification for engagement
- 33:39Motivation and inclusivity
- 34:42Call to action
related talks
51mBuilding Security Champions
27mSecurity Champions: The What, Why, and How
49mTransforming Security Champions
37mBuilding Security Champions
32mSecurity Champions? Introduce them in your Organisation
48mGrowing A Security Champion Program Into A Security Powerhouse
16mSecurity Champions The What, Why, and How
35mSDL at Scale: Growing Security Champions