A programme does not mature by doing more; it matures by changing the shape of its network. Security Champions programmes tend to follow the same arc. In the first year the numbers look good: champions recruited, coverage reached, awareness up, a lively community. In the second year awareness holds, behaviour stays flat, and more of the same effort does not move it. Existing maturity models cannot explain this because they grade activity and governance. This one grades structure: five stages defined by the amount of reinforcement a behaviour can need and still spread from the champions to everyone else.
Dotted terms show a short explanation when you point at them, or tap them on a phone.
People hold thresholds. Each of us adopts a behaviour once enough of the people around us have, and the enough differs from person to person and from behaviour to behaviour. A behaviour that needs reinforcement from several contacts cannot cross a single long tie, because the person at the far end sees only one adopter. It spreads through clustered neighbourhoods, where a person's contacts also know each other, and across wide bridges between them. That is the distinction between simple contagion, which carries information, and complex contagion, which carries behaviour, and it is set out in full on the network models page.
From this comes a definition. The carrying capacity of a champions network is the highest reinforcement threshold a behaviour can have and still spread from the champions, through the network, to the rest of the organisation. A network with a carrying capacity of one carries awareness and alerts. A capacity of two carries awareness and the lighter behaviours, the ones a person will try after seeing a couple of colleagues do them. A capacity of three carries the behaviours that matter most to a security function: the ones that cost something, and that a person will not adopt until several people around them have.
Carrying capacity is a property of the network's structure and of where the champions sit in it, not of the champions' knowledge or enthusiasm. That is why it is the right quantity for a maturity model to grade, and why the models in use, which grade activity, governance or stated intent, keep reporting success at the plateau.
| Common programme target | Needs | Why |
|---|---|---|
| Know that a lure is circulating; know where the report button is | 1 | Information. Nothing about the person's situation has to change. |
| Try the report button once; attend a session | 2 | Low cost, low exposure. Two colleagues doing it is permission enough. |
| Report routinely, including false alarms | 3 | Costs time and risks looking jumpy. Needs a team where reporting is normal. |
| Pause on an urgent request that carries authority | 3 | Risks the relationship with the requester. Needs visible peers who also pause. |
| Use the password manager; stop sharing credentials | 3 | Conflicts with habit and with how the team has always worked. |
| Hold a rehearsed response under pressure (a brace) | 4 | Held by a team or not at all. The champion cannot hold it alone. |
The thresholds are judgements rather than measurements; a field study could estimate them. The ordering is what matters. The top two rows are awareness, and they are what a programme achieves in its first year. The rest are behaviour, and they are what it was created for.
Each stage is described on five dimensions: structure (the shape of the network and where the champions sit), carriage (what it can carry, as a threshold), selection and role (how champions are chosen and what they are asked to be), security function (where it sits relative to the network) and measurement (what the programme counts). Stages 1 and 2 build a network that carries awareness. Stages 3 to 5 need a differently shaped network to carry behaviour. Between them is a change of structure, not a slope.
There is no network. Security has a few informal contacts in the business, usually the people who have complained most usefully. Nothing is designed.
Champions have been recruited against a ratio and a list exists. The network is hub and spoke: each champion is tied to the security function and to a small fan of colleagues, and champions do not know each other. Alerts and content go out from the centre and reach every team in two hops. Coverage and message reach both look good quickly. This stage is reached in months, and it is where many programmes stay.
The champions have a channel, a regular meeting and events of their own, and they have become a community of practice. They know more, stay longer and speak up more. Structurally they are now a single dense cluster, tied to each other far more than to their teams, and the reinforcing structure that behaviour needs has been built among the people who have already adopted. Awareness is at its plateau. This is where the second-year arc begins, and where most mature-seeming programmes sit.
The transition is a change of shape: from a single cluster of champions to champions clustered inside their teams. It is not crossed by doing more of what Stage 2 does. More content, more sessions and a bigger community are more Stage 2, and in the model they move nothing. The way over is to move champions, or choose new ones, so that each target team has two or three who know each other and are tied to most of the team; to thin the community to a backbone; and to start counting what reaches colleagues rather than what reaches champions. It is harder and less pleasant than the Stage 2 work, because it trades the champions' community, which is warm, for the teams' resistance, which is not, and it lowers the coverage number the programme has been reporting. A programme owner who understands the model can make that trade knowingly and explain it upwards.
The network has been rebuilt. Champions sit in pairs or triads inside the teams whose behaviour is the target, chosen for their position in the team rather than their interest in security, with their security-related ties mostly inside the team. The champion community survives as a thin backbone for alerts and identity. A colleague can now see several adopters at once, teams begin to tip, and the first behaviour lines move. Coverage has fallen, which is the price, and the programme has to be able to say so.
Tipping has crossed from seeded teams to their neighbours and from department to department. The programme has deliberately widened bridges: pairing seeded teams with unseeded ones, placing champions on existing cross-team ties, and making sure departments are bridged to each other and not only teams within a department.
The behaviour has become a team norm that holds when the champion leaves. Tipped teams produce new champions without recruitment drives, the security function has moved from the centre of the network to its edge, and the programme's work is maintenance and the next behaviour rather than this one. Carrying capacity is no higher than at Stage 4; what has changed is that the network no longer depends on the champions to hold what it carries.
The scoring is non-compensatory on purpose, in the tradition of the staged Capability Maturity Model. A programme with an excellent champion community and no embedding is at Stage 2, however good its community is, because the community does not change what the network can carry. Each gate is checkable from the programme's own records or from a short organisational network survey.
To make the central claim exact, we simulated the network at each of the first four stages and measured its carrying capacity: 1,200 employees in sixty teams of twenty, twelve departments, sixty champions placed as each stage prescribes, and four behaviours differing only in how many adopting contacts a colleague needs before adoption becomes possible. It is an illustration of a mechanism built from standard models with plausible parameters, not evidence that it operates in any real organisation.
| Stage | Needs 1 | Needs 2 | Needs 3 | Needs 4 |
|---|---|---|---|---|
| 1 Roster | 100% | 100% | 6% | 5% |
| 2 Community | 100% | 100% | 6% | 5% |
| 3 Embedded | 100% | 100% | 73% | 5% |
| 4 Bridged | 100% | 100% | 95% | 5% |
Stages 1 and 2 can be located from programme records: the roster, the channel, retention and attendance. The free Champions Programme Health Check gives a first read in about ten minutes, with the caveat that it is the programme's view of itself. Stages 3 to 5 need a short organisational network survey, asking each person who they go to for security advice, who they would tell about a suspicious message and who they talk to about work, together with a direct measure of the target behaviour that does not rely on self-report.
From those, the Stage 3 gates read off as champion embedding, the exposure count distribution and the list of tipped teams; the Stage 4 gates as bridge width, tipped teams per department and the lag from a team tipping to its neighbours; and the Stage 5 gates as persistence in teams whose champions have left and the appearance of new champions in tipped teams. All of it is checkable with a survey, a spreadsheet and a network library. What it needs is the decision to measure what reaches colleagues.
Recruitment and a route from the centre to every team. Months, not years.
Building the champions' community. It is worth doing, and the model keeps it, as the thin backbone of Stages 3 to 5. What the model refuses is the idea that a better community is a step towards behaviour. It is a step towards better champions, which is not the same.
Restructuring. Choose champions by position and nomination rather than enthusiasm; place them in pairs and triads in target teams; move the programme's attention from the community to the teams; thin the backbone; change what is counted. It lowers the coverage number, and it has to be explained upwards before it is attempted.
Pair seeded teams with unseeded ones; place champions on existing cross-team and cross-department ties; watch the departments where nothing has tipped.
Rotate champions out of tipped teams and see whether the behaviour holds; recruit from tipped teams rather than by drive; move the security function to the edge of the network it built.
Grading by activity. A programme that reports coverage, attendance and content is reporting its Stage 1 and 2 capacity, and will report it forever, because those numbers do not fall when the behaviour line stays flat.
Treating Stage 2 as the destination. The champion community is the most visible and most rewarding part of the programme. It is where the programme owner spends their time, where the enthusiasm is, and where the security function feels at home. Investing in it feels like progress. The identical rows in the simulation are the reason it is not.
The homepage routes you by where you are. Each of the three journeys maps onto a part of the model, and each journey page now says which stages it covers and what the model asks of you there.
The planner takes you from nothing to a roster with a route to every team. The model's advice is to decide the shape now: recruit by nomination, in pairs per target team, and count what reaches colleagues from the first quarter, so that the wall is a step you planned rather than one you hit.
Start here →Five people who already run a network, each with a challenge we hear constantly, and each one placed on the model. Most of them are at Stage 1 or 2 and being asked a Stage 3 question with Stage 2 metrics.
Find your challenge →Awareness has plateaued and the behaviour line is flat. This journey is the restructuring, the bridging and the letting go, with the diagnostic method and the measurement to go with them.
Go beyond →The model's first demand of a programme is to stop grading itself by activity. HEROES by CyBehave is built that way. The Behaviour Index, part of Base from day one, comes from colleagues rating the security behaviours they observe in their own team every quarter, independent of the champions and the training platform; it is a measure of what the network carried, not of what the programme did. Programme Capability, with the Measure & Evidence module, is the programme's own view, kept deliberately separate. Network Strength, with Network Optimisation, is where the Stage 3 and 4 measures live: embedding, bridges, isolation and the gaps to recruit into. The rater-disjoint measurement work in the Lab explains why the three are kept apart.
The model on this page is set out in full, with the review of existing maturity models, the simulation, its limits and the references, in a working paper from the CyBehave Lab, the second of a pair. The paper also describes the field study that would test it: a programme willing to restructure, a network survey before and after, and a behaviour measured directly for at least a year. The prediction is specific. Awareness measures will not change across the restructuring; behaviour measures will; and the teams in which they change will be the ones whose exposure counts crossed the threshold.
Wood, A. (2026). A Security Champion maturity model: Carrying capacity, the awareness plateau and the wall between simple and complex contagion. Working paper, version 1, 24 October 2026. CC BY-NC 4.0.
The free Champions Programme Health Check gives you a first read on your programme in about ten minutes. Stages 3 to 5 need a measure of what reaches colleagues, and that is what Heroes is for.