Building a Champions Network That Works, part 4 of 7
Ask a programme manager how they recruit champions, and you will get one of two answers. Either they put out a call and took whoever came forward, or they asked each department head to nominate someone and took whoever was named. Both approaches are common, both produce a network, and both, in our experience, produce a network that is weaker than it looks. A third approach rests on understanding what a champion is actually for.
What recruitment is really selecting for
A champion's value is not their enthusiasm for security, their knowledge of it or their willingness to attend meetings. It is their position in their team's working relationships. Behaviours that carry a cost, and every security behaviour carries one, spread when people see several trusted peers doing them. Damon Centola's work on complex contagion made that point for social behaviour generally, and Thomas Valente's work on network interventions made it operational: if you want a behaviour to spread through a group, choose the people others already watch and copy, not the people who are keenest to help.
That reframes recruitment entirely. The question is not "who wants to be a champion?" or "whom can we spare?" but "who does each team actually take its cues from?" Once you ask that, the weaknesses of the two standard approaches become obvious.
The volunteer model
Volunteers are the default because they are easy and because they arrive motivated. The motivation is real and valuable. The problem is who volunteers. An open call attracts people who were already interested in security, and those people cluster in the parts of the organisation where security was already reasonably strong: technology, risk, compliance, project management. The teams that generate the most human risk, often operations, sales, finance and customer-facing roles, produce few volunteers because nobody there thinks of security as their business.
The second, quieter problem is that volunteering selects for availability rather than influence. The colleague who has time to put their hand up is frequently not the colleague whose behaviour others copy. When we built our first large network, the opening cohort came entirely from volunteers, and it was well trained, enthusiastic and almost invisible to the teams it was supposed to influence. The network looked healthy in the spreadsheet and did very little to behaviour until we changed how we recruited.
Volunteer networks also inherit the volunteer's timeline. People who chose to join can choose to leave, and often do when workload rises, leaving gaps in exactly the areas that were hardest to fill.
The voluntold model
The opposite approach, asking managers to nominate or simply appointing champions to every team, solves coverage and creates a different failure. Appointed champions arrive without the motivation the volunteers had, and often with some resentment at a role they did not ask for. Herbert Kelman's distinction between compliance, identification and internalisation is useful here. A person who complies does the minimum while being watched. A person who identifies does it because they value the group. A person who internalises does it because it has become part of who they are. Appointment tends to produce compliance, and compliance produces performative champions: present at the meeting, absent from the behaviour.
There is a subtler issue too. Managers asked to nominate someone tend to choose whoever is least busy, newest, or most junior, which is to say the person with the least influence in the team. Coverage goes up on paper, and the network's actual reach into behaviour barely moves.
Appointment is not always wrong. In regulated environments, or where every unit requires a named accountable person, some form of designation is unavoidable. But designation without influence and without choice is a list of names, not a network.
The third approach: targeted invitation
The alternative is to identify influential people first using organisational network analysis, then invite them personally. ONA maps the real relationships in a team: whom people go to for advice, whom they trust, who connects otherwise separate groups. You can do it from a short survey, from existing collaboration data, or from both, and it doesn't need to be exhaustive to be useful. Even a light mapping of a priority business unit will show which handful of people sit at the centre of its working life.
Three kinds of people emerge from a map, and each matters for a different reason. Central people have many strong ties inside a team; the team copies their behaviour day to day. Bridges connect a team to others; Ronald Burt described them as spanning structural holes, and a bridge champion carries behaviour across boundaries that a central person cannot reach. And isolates, the people with few ties, are the ones to avoid recruiting, however willing they are, because they have nobody to influence.
Position is necessary, but it is not sufficient, and the research is detailed on that too. Coronges and colleagues studied how phishing warnings travelled through a real organisational network in 2012 and found that the most central people did not, on their own, warn anyone. Influence that is never activated changes nothing. And a 2023 case study by Sasse and colleagues at a large e-commerce firm found that champions appointed across five teams without proper support produced results that varied wildly from team to team. The lesson from both is the same: choose for influence, then invest in the person, because the map tells you who can carry the behaviour, and only support and motivation determine whether they will.
Once the map exists, recruitment becomes a set of individual conversations. The person is approached directly, ideally with their manager's support and the sponsor's name behind it, and told plainly why they were chosen: their colleagues already look to them. Then they are given a real choice.
That choice is not a courtesy; it is the mechanism. Self-determination theory, from Deci and Ryan, holds that motivation is sustained when people experience autonomy, competence and relatedness. Targeted invitation supplies all three. The person chooses freely, which preserves autonomy. They are told they were chosen for something they are already good at, which affirms competence. And the role connects them to a network of peers, which provides relatedness. Being asked personally for a reason produces something neither an open call nor an appointment can: a champion who is influential, who chose the role, and who feels seen.
What targeted recruitment produces
Networks built this way look different from the start. They are smaller in the first cohort, often fifteen to twenty rather than fifty, but each champion is positioned where it counts. Coverage is measured not as headcount per department but as the share of priority teams that have a central or bridging champion, and that measure moves behaviour in a way headcount never did. Attrition falls because people who were chosen and chose back stay longer than volunteers or appointees. And the network map, refreshed between cohorts, tells the programme exactly where to recruit next.
There is a blend worth naming. Some organisations run targeted invitations as the core and keep an open door for volunteers alongside it, on the understanding that volunteers are welcome, but placement decisions are driven by the map. That preserves the energy of the people who put themselves forward while ensuring the network's shape is designed rather than accidental. What matters is that the map leads and the call follows, not the other way round.
Seeing it in practice
This approach was rare until recently because network mapping used to be a research exercise. It is now practical inside a programme. CyBehave Heroes records whether each champion was a volunteer or was assigned, so the two can be compared over time, and its Social Network Analysis maps influence reach by connection rather than title, surfaces the bridge nodes whose loss would fragment the network, and identifies the isolated champions who are unlikely to be changing anything. The map that tells you who to recruit is the same map that tells you, later, whether the recruitment worked.
Recruitment is the decision that most determines whether a champions programme changes behaviour or merely exists. Volunteers bring motivation without reach. Appointment brings reach without motivation. Choosing the influential and asking them well brings both, and it is the only one of the three that starts from what a champion is actually for.
About this series. Building a Champions Network That Works is a seven-part guide from CyBehave to starting, funding, recruiting, scaling and measuring a security champions programme, and to the shift from awareness to behaviour change that sits underneath all of it. Previous: Part 3, Where to start: the first ninety days. Next: Part 5, How to scale without losing what made it work.