Security Champions The What, Why, and How
summary
Known vulnerabilities outpace fixes — 18,000+ CVEs and 66+ zero-days in 2021 — so the solution is to scale security inside teams by training local experts. Proposes a repeatable program: one champion per team with 10–15 hours training, geared to OWASP Top 10, SANS Top 25, threat-model basics and scan triage. At scale this moves remediation from months to 1–3 days for critical alerts; IBM/Red Hat pilots hit ~10% champions coverage and faster, fewer false-positive resolutions.
AI-written summary · about
chapters (11)
- 0:00Introduction and speaker background
- 1:03Rising security breach costs and risks
- 3:18Securing cloud-native and open source software
- 5:45The need for security champions programs
- 7:10Defining security champions roles
- 8:13Starting a security champions program
- 9:17Training plan for security champions
- 10:21Running a secure engineering guild
- 10:41Success at IBM Digital after 12 months
- 12:26Key takeaways and implementation steps
- 13:27Q&A and closing remarks
related talks
27mSecurity Champions: The What, Why, and How
32mSecurity Champions? Introduce them in your Organisation
36mChampioning Security: Scaling Security at Every Level
51mBuilding Security Champions
37mBuilding Security Champions
32mBeyond training: Building a high-impact security champions program
01h 01mSecurity Champion Worst Practices
35mSDL at Scale: Growing Security Champions