Get the business behind a Security Champions programme.

You know a Champions programme is the right thing to do. The people who hold the budget need to know it too. This is the route from an idea to a sponsored, funded programme with a start date: six steps, in the order they tend to work. It draws on The Rise of the Security Champion, our free ebook on building a Champions network, which the planning tool refers to throughout.

Begin with the pitch → Use the planning tool

1The 60-second pitch

Say it in a lift, not a slide deck.

Executives decide whether to keep listening in the first minute. The pitch has to say what the problem is, why the usual answer has stopped working, what you are proposing instead, and what you need. Nothing else.

Use the version opposite as it is, or adapt the three shorter forms for the corridor, the email and the one-line answer to "what is this about?"

Most of our security incidents start with something a person did or did not do. We have trained everyone, and completion is high, but the behaviour has not changed. Training tells people what to do. It does not change what they do when nobody is watching.

What changes behaviour is the people around us. I want to build a small network of Security Champions: trusted colleagues in each team who make secure behaviour normal where they work. It costs them twenty to thirty minutes a week. It costs us a coordinator's time and a platform to run it.

In ninety days I can have the first cohort recruited, a baseline measured, and the first behaviour we are targeting agreed. In a year I can show you whether behaviour has moved, measured by the people who work alongside them. I need a sponsor, a decision on the platform, and permission to ask twenty people.

One lineWe have trained everyone and behaviour has not changed. Champions change behaviour where it happens, and we can measure it.

The corridorOur incidents are mostly human. Training alone has plateaued. I want twenty trusted people across the business to make secure behaviour normal in their teams, and a way to prove it worked. It is cheap and I can start in ninety days.

The email subject lineA ninety-day plan to turn security training into security behaviour

2Why Champions

Three things a Champions network does that nothing else can.

A Security Champion is a member of the workforce, not the security team, who takes on a voluntary peer-facing role. A network is what you get when those people are connected, coordinated and supported as one programme. These are the arguments that land with leadership.

It changes behaviour, not just knowledge

People adopt behaviours because of the people around them: social proof, trust and peer modelling. Training raises awareness; a trusted colleague in the room changes what people actually do. Champions are the mechanism through which peer-led behaviour change operates at scale.

For the board: the human factor in incidents is addressed at the point where behaviour happens.

It puts security inside every team

A security team cannot be in every meeting or every decision. A Champion in engineering, finance, HR and operations means security thinking is present when the work is being done, not bolted on at the edges after the fact.

For the board: coverage of the whole organisation without growing the security headcount.

It gives you evidence, not activity

A network with structure produces data: who is active, which teams are covered, what colleagues observe, and whether behaviour is moving. That turns the annual "we did the training" report into a trend the board can act on.

For the board: a measurable line on security culture, three times a year.

Want the longer version? Read What is a Security Champion? and What is a Champions Network?

Free ebook

The Rise of the Security Champion

Everything in this route, and a great deal more, is in the book: why Champions work, how to design and recruit a network, launching, measuring, reigniting a stalled programme, and sustaining it. Nine chapters, free to download, no sign-up needed.

Get the book →

3The business case and ROI

One page. Costs on one side, what you get on the other.

A Champions programme is unusually cheap for what it does, and the business case should make that visible. Put the honest cost of people's time next to what an incident costs and what the programme measures, and let the reader do the arithmetic.

Use the outline opposite as the structure of your document. Keep it to one page for the decision, with detail in appendices for whoever asks.

What it costs

Champion time: 20 to 30 minutes a week, per Champion
Coordinator time: a share of one person's week
A platform licence for the base capability
A sponsor's visible support, twice a quarter

What it returns

Fewer incidents that start with a person, in the teams covered
Faster reporting of the ones that do happen
Security present in decisions before they are made
A measured trend in behaviour the board can see

On the numbers: use your own. Your incident history, your loaded hourly cost, and your team count are the figures a finance director will trust. Multiply Champion time by your cost per hour to get the honest programme cost, and set it against the cost of the last incident that started with a click.

The one-page business case

The problem in one paragraphWhat share of your incidents start with a person, and what the last one cost. Your numbers, not an industry statistic.
Why the current approach has plateauedTraining completion, phishing click rate, and the fact that neither has moved in the last year.
What you are proposingA Security Champions network: how many people, which teams first, what they will do each week, and who coordinates it.
What it costsChampion hours, coordinator time, platform licence. One total, per year.
What success looks likeThree to five specific, measurable goals. Behaviour observed by colleagues, coverage of teams, reporting rates.
How you will measure itA baseline in the first quarter, then a reading three times a year, from people who are not the Champions.
The 90-day planWhat will exist at day 30, 60 and 90. Step 5 below gives you the plan.
What you needA named sponsor, a decision on the platform, and permission to recruit the first twenty.

4The planning tool

Plan it in the Champions Journey Planner.

Five stages and thirty-one actions, from the first conversation with a sponsor to an established programme. Stages 1 to 3 are your first ninety days, and step 5 below lays them out on a calendar. The planner has a page of its own, and it keeps your place in your browser.

Open the planner → Reigniting a stalled network?

5The 90-day plan

What will exist at day 30, 60 and 90.

Sponsors say yes to plans with dates. This is the first three stages of the planning tool above laid out on a calendar: what will exist at each checkpoint, and which stage to be working through to get there. Adapt the numbers to your organisation, but keep the order: sponsor before recruitment, baseline before intervention.

Days 1 to 30

Planner stage 1 · Planning & Foundation

Sponsor, scope and structure

Named executive sponsor, with two dates in their diary
Three to five programme goals written down
Coverage model chosen: by team, site or function
First behaviour to target agreed
Platform decided and set up

At day 30: a programme exists on paper with a sponsor behind it.

Days 31 to 60

Planner stage 2 · Design & Recruit

Recruit and baseline

First cohort recruited: ten to twenty, chosen for trust, not technical depth
Manager agreement for each Champion's time
Onboarding and the first Champion meeting
Baseline measured, from colleagues in covered teams
Champion check-in captured

At day 60: real people are in the programme and the starting line is drawn.

Days 61 to 90

Planner stage 3 · Launch & Develop

First intervention and first report

First intervention designed against the target behaviour
Champions running it in their teams
Engagement calendar agreed for the next two quarters
Coverage map and first status view shared with the sponsor
Date set for the first follow-up measurement

At day 90: the programme is running, visible, and has a date on which it will show a result.

Stage 3 of the planner runs on past day 90, and stages 4 and 5 (Measure & Optimise, Scale & Sustain) are the programme once it is established. Back to the planning tool to tick off what you have done.

6Deliver it with Heroes

The plan above is what the base platform is built to run.

CyBehave Heroes is the Security Champions platform. Every step in the 90-day plan has a home in Base, the platform every subscription starts with, and the measurement that makes your business case credible is built in from day one. As the programme matures, planned add-on modules take it further.

Recruit and coordinate

Champion management, tasks, events and an engagement calendar, with a coverage map that shows the sponsor which teams are covered.

Baseline and measure

The peer pulse gives you a Behaviour Index baseline in the first quarter, measured by colleagues. Add Measure & Evidence when you need Programme Capability and a board pack.

Design and run interventions

Priority behaviours from the catalogue and a guided designer that follows a scientific method, without you needing to be a behavioural scientist.

Start free trial → Explore Heroes Base platform and modules