Security Champions Networks

One Champion is a role.
A network is a capability.

A Security Champions Network is what happens when individual Champions are connected, coordinated and supported as one programme. It is the difference between a few motivated people doing good work in isolation and an organisation that can see, measure and improve how its people behave around security.

What is a Security Champion? See the use cases →
The Difference

What makes a network more than a list of Champions?

Most organisations that say they have a Champions programme actually have a list. A list of people who were nominated, volunteered or were told to attend a briefing. Some of them are active. Nobody is quite sure which ones. There is no structure connecting them, no shared cadence, and no way of knowing whether the whole thing is having any effect.

A network is different in kind, not just in size. It has coverage, so you know which teams have a Champion and which do not. It has connection, so Champions learn from each other rather than reinventing the same conversation in twenty places. It has coordination, so the security team can ask the network to do something and see it done. And it has feedback, so what Champions hear on the ground comes back to shape what happens next.

Individual Champions
Good people doing good work
  • Effective within their own team, invisible beyond it
  • Rely on personal motivation to keep going
  • No way to compare or share what is working
  • Activity is anecdotal; impact is a matter of belief
  • When a Champion leaves, their work leaves with them
A Champions Network
An organisational capability
  • Coverage across teams, sites and functions is known and managed
  • Shared playbooks, cadence and support keep momentum going
  • Champions are connected to each other and to the security team
  • Activity, engagement and behaviour change are measured
  • The network outlasts any individual member
The Anatomy

Five things every working network has

Whether a network has fifteen Champions or five hundred, the same properties determine whether it works. They are not complicated. They are just easy to neglect when the network is being run from an inbox and a spreadsheet.

The first three are operational: knowing who you have, keeping them engaged, and being able to ask them to do things. The last two are about learning: hearing what comes back from the ground, and knowing whether any of it changed behaviour.

A network can be perfectly healthy on the first three alone. Many are. The last two are where a network stops being a communications channel and starts being a source of evidence.

Coverage

Every team, site and function that matters has a Champion, and you know where the gaps are. Coverage is the first thing a network manager should be able to see and the first thing that decays if nobody is watching.

Cadence

Champions meet, hear from the security team, and hear from each other on a rhythm that fits their working lives. Without cadence a network quietly becomes a list again.

Coordination

The security team can assign a task, run an event, or ask for a local intervention and see who has done it. Coordination is what turns goodwill into action at scale.

Feedback

What Champions hear from their colleagues comes back to the people designing controls and communications. The network is the best intelligence source most security teams never use.

Evidence

The network can show, not just claim, that behaviour has changed. This is the property that justifies the investment and the one that takes longest to build.

The Programme Journey

Six programme stages. Modules that arrive when you need them.

Nobody starts with a mature network and nobody needs a research instrument on day one. A programme that is still recruiting its first twenty Champions has different needs from one that is defending its budget to an audit committee, and both are different again from one that spans eleven countries and a works council.

Heroes tracks every programme through the same six stages, from Setup to Evolve, and the platform shows you which stage you are at and what the focus should be. The modules follow the same arc. You take what fits where you are now and add more as the programme moves on. Nothing you used at an earlier stage is wasted; the operational data you collect while simply running the network becomes the measurement data you rely on later.

1
Setup
Get launch-ready
Sponsor, business case, coverage model and recruitment plan.
Business caseCoverage modelStarter playbook
2
Launch
Build it in the platform
Structure, Champions, calendar and a baseline to measure from.
TasksEventsChampion statusBaseline
3
Embed
Build the routines
First interventions, a feedback loop, a growing Champion community.
Feedback loopIntervention playbooksPeer pulse
4
Mature
Optimise and evidence
Refine what works, expand coverage, show the return.
Behaviour IndexNetwork StrengthNetwork viewEvidence packs
5
Sustain
Keep the energy
Spot complacency early and renew the network as the organisation changes.
Champion surveysMaturity profileRe-launch playbooksBoard view
6
Evolve
Adapt and benchmark
A recognised capability that compares itself to peers and keeps learning.
Multi-entityBenchmarkingResearch modeData export

The stages are cumulative but nobody is hurried through them. A network can sit at Launch or Embed for years and be well served. The point is that when you do want to ask the harder question, "has any of this changed behaviour?", the answer is already being assembled from the work you were doing anyway.

Where Are You Now?

Different starting points, one platform

These are the four situations we see most often. Most people recognise themselves in one of them, and most programmes move through two or three over the life of a subscription. Each one shows which programme stage you would start at in Heroes and what you would add next.

The founder

You have been asked to set up a Champions programme, you have never run one, and you are doing it alongside everything else. You need something credible standing within a quarter that will not collapse in six months.

Start with

Business case template, a guided steer on volunteer or assigned Champions, a starter playbook with the first ninety days laid out, and a baseline captured before anyone notices.

The coordinator

You run a working network, or have inherited one, from Outlook, a SharePoint list and a Teams channel. You are not being asked about behaviour change and do not need to be. You need to know who is active, who is drifting, where the gaps are, and to stop losing track.

Start with

Tasks with completion tracking, events with attendance, a feedback loop with Champions, and a status view showing leaders, laggers, decliners and coverage by team or site.

The awareness lead

Your network works. Champions share content, support phishing simulations and staff the stand in October. Completion is high, click rates have plateaued, and your CISO has started asking what has actually changed.

Start with

Import your existing Champions and history. Behaviour Index built from peer pulse, independent of your training platform. Playbooks that give Champions specific local interventions to run.

The behavioural specialist

Your network is already behaviour-led. What you lack is instrumentation. You have run interventions and seen results but cannot separate the effect of the Champion from the team, the manager or the timing, and every tool you are offered was built for a compliance team.

Start with

Research mode with the measurement model exposed, Network Strength and centrality measures you can relate to behaviour outcomes, the psychometric basis for the Behaviour Index, and raw pulse and network data export.

Modular by Design

Choose the modules you need now. Add the rest as the programme matures.

Heroes is not one product you have to swallow whole. It is a set of modules, each labelled with the programme stage it typically arrives at, sharing one data model. The operational features a coordinator uses every week, tasks completed, events attended, feedback given, Champions drifting, are the same signals that feed the Behaviour Index, the Network Strength score and the maturity profile above them.

That is why you never have to switch measurement on. You start with what you need to run the network, and when you are ready to ask harder questions, you find the answers were already being assembled.

Setup

Start well

For programmes starting from nothing or restarting after a stall.

  • Business case template
  • Volunteer or assigned model guidance
  • Starter and re-launch playbooks
  • Baseline capture
Launch

Run the network

The coordination modules. Everything a network manager needs to keep a programme moving without a spreadsheet.

  • Task assignment and completion
  • Events and attendance
  • Champion feedback loop
  • Leaders, laggers, decliners and coverage
Embed to Mature

Prove behaviour change

Independent evidence that Champion activity changes what colleagues actually do.

  • Behaviour Index from peer pulse
  • Intervention playbooks
  • Trend by team and site
  • Import of existing programme history
Mature

Understand the network

See the network as a structure rather than a list.

  • Network Strength score
  • Champion surveys
  • Organisational network analysis
  • Interactive network view
Evolve

Grow across entities

One programme, many entities, consistent measurement.

  • Multi-entity structure
  • Localised playbooks
  • Aggregation and anonymity controls
  • Works council and DPIA documentation
Mature to Sustain

Defend the investment

Outputs built for audit committees, boards and client assurance.

  • Human Risk Maturity Profile
  • Framework-aligned evidence packs
  • One-page board view
  • Peer benchmarking
Evolve

Know why it works

For practitioners who want the full model, not a summary of it.

  • Research mode
  • Centrality and influence measures
  • Psychometric detail
  • Raw data export
Every stage

Whatever stage you are at

Included from Setup onwards.

  • Nudge coaching for Champions
  • Academy training pathways
  • Trust Centre and compliance documentation
  • Simple and research UI modes
Two Modes, One Platform

Simple for the people running it. Deep for the people studying it.

A coordinator should be able to live in Heroes for two years and never see a network graph. A behavioural specialist should be able to go as deep into the measurement model as they want. Both are true at once, because the platform has two modes over the same data.

Simple mode is the whole world for a network manager at any stage: tasks, events, feedback, who is active, where the gaps are. Research mode exposes the measurement model, the network analysis and the raw data for anyone who wants to interrogate it.

Moving between them is a setting, not a migration. Nothing is lost, and nothing has to be set up again.

Simple mode
Coordination first. Tasks, events, feedback and Champion status, with measurement running quietly underneath and surfaced only when asked for.
Research mode
The full model. Behaviour Index construction, Network Strength, centrality measures, survey instruments and data export for your own analysis.
Outputs for those who never log in
Board views, evidence packs and maturity profiles designed to be read by a CISO, an audit committee or a client, without any explanation of the method.
Restraint by default
Aggregation thresholds and anonymity are the default, not an option. The platform is designed to satisfy a works council before it is designed to satisfy a researcher.

Start where you are. Grow when you are ready.

Start your free trial of CyBehave Heroes - no credit card required.