Security Champion Worst Practices
summary
Security champion programs sound promising but over half of programs fail because goals, support and scope are vague. Practical fixes: set one or two concrete responsibilities (example: threat modeling for every significant change — a client with 3,000 devs uses three appsec staff to enforce this), limit expectations to an hour or two a week not 20, plan one event per month, track metrics (attendance, triages, SLA fixes), avoid forced volunteers, secure management time and budget, and measure triage work like triage SAST/DAST outcomes.
AI-written summary · about
chapters (16)
- 0:00Introduction and context
- 3:09Why start a champion program?
- 7:35Benefits of security champions
- 14:23Avoiding common pitfalls
- 21:00Defining goals and tasks
- 27:39Recruiting and engagement
- 33:22Attraction vs. recruitment
- 37:07Setting realistic expectations
- 38:56Getting management support
- 41:26Metrics and ROI
- 43:40Educational planning
- 45:41Motivating champions
- 47:15Social settings and culture
- 49:36Managing turnover
- 51:33Conclusion and resources
- 53:24Q&A session
related talks
41mSecurity Champion Worst Practices
51mBuilding Security Champions
27mSecurity Champions: The What, Why, and How
37mBuilding Security Champions
38mChampioning Security for your Agile Development
20mHow to fail at building a security champions program
36mChampioning Security: Scaling Security at Every Level
32mSecurity Champions? Introduce them in your Organisation