Security Champions And Experiments: Building Blocks For Cultural Change
summary
Claim: embed security champions and run controlled experiments to change culture. Implementation at Bankdata: ~600 developers across 80 teams, aiming for ~30 champions with two per business area, 20% time allocation, monthly full‑day workshops, a six-step recipe (buy‑in, volunteers, comms flow, experimental mindset, engagement, visibility). Built a communication pipeline and a champions core, use experiments and semi‑structured interviews to evaluate, and delegate triage SAST results to champions — early results show more team outreach and newly discovered issues.
AI-written summary · about
chapters (16)
- 0:00Introduction and approach
- 2:14Speaker background
- 3:45Organization overview
- 5:12The people problem
- 7:21Legacy security challenges
- 9:06Finding the missing link
- 11:13Defining the role
- 13:49Program implementation
- 15:24Recruitment strategy
- 16:51Communication flow
- 18:22Experimental mindset
- 22:04Hypothetical experiments
- 23:34Engagement and training
- 26:41Bottom-up culture change
- 27:48Summary and conclusions
- 30:36Q&A session
related talks
27mSecurity Champions: The What, Why, and How
51mBuilding Security Champions
49mTransforming Security Champions
32mBeyond training: Building a high-impact security champions program
20mBuilding security culture on infrastructure teams
32mSecurity Champions? Introduce them in your Organisation
24mConcrete Steps to Create a Security Culture
47mElite Security Champions Build Strong Security Culture in a DevSecOps World