Security Champion Worst Practices
summary
Claims that over half fail and that clear goals, measurables and sustainable pace fix most problems. Evidence comes from surveys of a few thousand people, consulting with 52 organizations, building two in‑house programs and helping ~49 companies; examples include a Quebec org that threat‑models thousands of apps. Concrete fixes: start slow (one event per month), plan six months, track metrics like triage time and champion coverage, provide training (We Hack Purple Semgrep Academy) and replace or reward inactive champions.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 2:28Security Champion Program
- 7:05Why start a program
- 12:27Common program failures
- 24:08Realistic expectations
- 30:44Engaging champions
- 35:01Reducing turnover
- 38:53Conclusion
related talks
01h 01mSecurity Champion Worst Practices
16mSecurity Champions The What, Why, and How
51mBuilding Security Champions
27mSecurity Champions: The What, Why, and How
20mHow to fail at building a security champions program
36mChampioning Security: Scaling Security at Every Level
32mSecurity Champions? Introduce them in your Organisation
37mBuilding Security Champions