How to fail at building a security champions program
summary
Describes a reproducible failure mode and a practical alternative: treating a champions program as a mechanism with defined inputs and outputs and piloting with specific team types—easy win / high impact / high risk—rather than flipping it org‑wide. Claims show the Guardian is a builder who is empowered to make day‑to‑day security decisions while security engineers support, and warns against hiring outsiders instead of converting builders. Emphasizes KPIs tied to business goals, start small, iterate, and measure faster decisions and reduced reviewer load.
AI-written summary · about
chapters (6)
- 0:00Introduction to Guardians
- 3:38Distributing security
- 8:11Common failure pitfalls
- 10:15Aligning with business goals
- 13:10Strategies for piloting
- 18:02Common staffing mistakes
related talks
49mTransforming Security Champions
51mBuilding Security Champions
01h 01mSecurity Champion Worst Practices
32mBeyond training: Building a high-impact security champions program
48mGrowing A Security Champion Program Into A Security Powerhouse
41mSecurity Champion Worst Practices
47mElite Security Champions Build Strong Security Culture in a DevSecOps World
37mBuilding Security Champions