Building a Champions Network That Works, part 5 of 7
A champions programme that works at twenty people often stops working at two hundred. The activities are the same, the enthusiasm is there, the numbers look better than ever, and yet the effect on behaviour thins out until the programme is a mailing list with a training budget. Scaling a network is a different problem from starting one, and people usually solve it with the wrong tools. This article covers what changes as a network grows, and how to grow it without diluting what made it worth having.
Understand what you are actually scaling
When a programme is going well, the instinct is to add champions. More champions, more coverage, more impact. It sounds obvious, and it is half wrong. Behaviour change comes not from the number of champions, but from the strength of their ties to the teams around them. A network of 300 champions who are each peripheral to their teams will change less than a network of 100 who are central. We're scaling influence, and influence doesn't add up the way headcount does.
This matters because research on complex contagion shows that a person adopts a costly behaviour when several people they trust are doing it, not when one distant colleague is. As the network grows, the question for every new champion is not "does this team have someone?" but "does this team now have enough trusted people modelling the behaviour that the rest will follow?" Coverage is the wrong measure. Density within teams is the right one.
Grow by cohort, seeded from the network map
The 550-person network we built over 18 months grew in cohorts, each one recruited from a refreshed network map rather than from an open call. Between cohorts, we looked at where existing champions had influence and where they did not, and we aimed the next cohort at the gaps. Some cohorts went into new business units. Others went into units that already had champions but where the analysis showed the champions were isolated from the people who mattered.
Cohorts have a second advantage that is easy to overlook. A group of forty people onboarded together becomes each other's peer group, and champions with a peer group stay longer. Attrition in our network was consistently lower among champions who could name others from their own cohort than among those who had joined singly. Growing in waves, with a shared onboarding experience, builds the network's internal ties while extending its reach.
Add a layer before you need it
Somewhere between fifty and a hundred champions, a single programme manager loses the ability to know everyone, and with it the ability to notice who has gone quiet. This is the point at which programmes begin to leak, usually noticed six months later when a check of the list finds that a third of the names have not engaged in a quarter.
The answer is a second tier: regional or divisional leads, drawn from the strongest early champions, each responsible for a group of perhaps fifteen to twenty. Their job is not administration. It is to keep the local network alive, spot disengagement early, run the regular local sessions that a central team cannot, and act as the first escalation point. Appoint them before the programme reaches the size where it needs them, because recruiting leads from a network that is already fraying is much harder than promoting from one that is healthy.
Protect the behaviour as the activity grows
Scale brings activity. Newsletters, awareness months, phishing campaigns, competitions, badges, town halls. Each of these is reasonable, and each pulls the programme toward things that can be counted rather than things that change behaviour. The drift is gradual, and nobody decides it. One day the programme manager notices that the monthly report is about reach and attendance, and that nobody has asked in a year whether champions are still visibly modelling careful behaviour in their teams.
Guard against this by keeping the original purpose statement in the programme's governance and testing new activities against it. For any proposed activity, ask whether it makes champions more visible as careful peers to the people around them. A local session where a champion talks through a near miss passes that test. A company-wide poster campaign does not, no matter how well designed. Both may be worth doing, but only one belongs to the champions programme.
Let the measurement grow with the network
At twenty champions, the programme manager can measure engagement by knowing who turns up. At several hundred, that is impossible, and the programme needs instrumentation. Three levels matter. Programme capability: are champions active, trained and retained? Network strength: are champions central in their teams, are the teams that matter covered at sufficient density, are the ties between champions themselves holding up? Behaviour: are reporting rates rising, are queries reaching the central team falling, is time to security review shortening in the teams with strong champions relative to those without?
That last comparison is the most persuasive evidence a scaled programme can produce. Once the network is large enough to have strong and weak areas, the difference in behaviour between them is the programme's effect, measured inside the organisation without external benchmarks. Building the measurement so this comparison is possible is a scaling decision, and it needs to be made before the network is large, not after.
Manage attrition as a feature, not a failure
Champions leave. They change roles, move business units, get promoted, lose interest, or simply finish what they came to do. In a healthy network, annual attrition of a fifth to a quarter is normal, and a programme that expects zero is setting itself up for disappointment. The mistake is treating each departure as a loss to prevent rather than a flow to manage.
Build a recruitment pipeline that runs continuously alongside the cohort model, so that a champion leaving a priority team triggers a targeted replacement rather than a gap. Make leaving easy and graceful; a champion who steps down well remains an ally and often returns. Use the network map to see whether departures are random or clustered, because a cluster of departures in one area usually signals a local management problem the sponsor needs to address.
Keep the identity intact
The final risk of scale is that the programme becomes generic. Early champions joined something small and distinctive; later ones join a large corporate scheme. The identity that made the first cohort feel chosen can dissolve into process. Social identity theory is clear that people sustain behaviour on behalf of a group they feel part of, and a champion who feels like a name on a list will behave like one.
Protect the identity deliberately. Keep the targeted invitation rather than reverting to open enrolment. Keep the cohort experience. Give champions a voice in how the programme develops, and visible recognition from the sponsor rather than from the security team. The network we built reached 550 people and still felt, to most members, like something they were asked to join rather than something they signed up for. That feeling is the asset. Everything else about scaling serves to keep it.
About this series. Building a Champions Network That Works is a seven-part guide from CyBehave to starting, funding, recruiting, scaling and measuring a security champions programme, and to the shift from awareness to behaviour change that sits underneath all of it. Previous: Part 4, Volunteer, voluntold or chosen: how to recruit champions who change behaviour. Next: Part 6, Moving on from the spreadsheet.