The Security Champions Network Blueprint

Why it matters

A network built because every organisation seems to have one carries nothing in particular. The networks that move behaviour were built to move a short list of named behaviours, for a sponsor who asked to see the behaviour line rather than the attendance figures. Decide the purpose first, because everything below it, from the shape of the network to what gets counted, follows from which behaviours the network exists to carry.

The decisions inside it

• Which behaviours is it for? Name three at most for the first year, and make at least one of them a behaviour that costs something: routine reporting including false alarms, pausing on an urgent request, giving up a shared credential. The light behaviours spread on their own. The costly ones are the reason a network exists.
• Who sponsors it? A business leader who will be shown the behaviour measure every quarter, alongside the security owner. If the security function is the only voice behind the network, the business treats it as security's project and lends it people accordingly.
• What will the sponsor see? Agree now that the first-year numbers (recruited, reached, trained) are not the measure, and that the coverage number will fall in the second year when the network is reshaped around target teams. A sponsor who hears this at the start can defend it later.
• Mandated or invited? A mandate fills a roster quickly and produces champions whose managers were told. An invitation produces fewer champions who stay. Most programmes need both, team by team, and the choice should be deliberate rather than the default of whoever answered the email.
• What does it cost? Champion time per month, agreed with line managers in writing, plus the programme owner's time and a small budget for recognition. A network with no agreed time is a list of names.

Where it goes wrong

• A purpose that reads "raise awareness". Awareness is what the network carries in its first year whatever you do; it is not a reason to build one.
• A sponsor who hears about the network twice a year and sees a coverage slide each time. They will defend the coverage number, and the change of shape that behaviour needs will look like a failure.
• Promising a champion ratio to the board. You will need to lower it, and the promise becomes the thing you are measured against.

What good looks like

• The target behaviours are written down, named, and agreed with the sponsor.
• A named sponsor outside the security function sees the behaviour measure every quarter.
• Champion time is agreed with line managers in writing, with hours per month.
• The second-year change of shape, and the coverage drop that comes with it, were explained before launch.

Across the stages

Go deeper

Why it matters

An alert crosses any shape of network, because one exposure is enough. A behaviour that costs something does not: a colleague takes it up only after seeing several people they know doing it, so it needs champions clusteredClusteringHow far a person's contacts also know each other. In a tightly clustered team everyone talks to everyone, so several people can show the same behaviour at once. A random network has almost no clustering. inside teams and wide bridgesBridgeThe ties that join one team to another. Bridge width is how many there are. A single tie is a narrow bridge: fine for news, too narrow for behaviour, which needs several ties into the next team before it can cross. between them. The same sixty champions, placed as scattered singles, carry nothing but alerts; placed as pairs in thirty teams, they carry the behaviour across the organisation. Draw the shape for behaviour before you recruit, even if the roster comes first.

The decisions inside it

• One layer or two? Two. A lower layer of champion pairs or triads inside the teams whose behaviour is the target, with wide bridges between neighbouring teams, where behaviour moves in months. An upper layer that is a thin backboneBackboneA deliberately thin set of ties among champions, and back to the security team, kept for alerts and a sense of identity and nothing more. among champions for alerts and identity, where information moves in days. Keep them distinct, and keep the backbone sparse so it never becomes the champions' home.
• Ratio or seeds per team? Seeds per team. One champion per twenty-five employees says nothing about whether any colleague ever sees two adopters at once. Two or three champions in each target team, tiedTieA working relationship between two people: they talk, ask each other for advice, or would pass on a warning. Network diagrams draw ties as lines. It is the pattern of ties, not the org chart, that decides what spreads. to each other and to most of the team, is the design parameter that matters.
• Which teams first? The teams where the target behaviour is most at stake, with strong closureClosureThe pattern in which your contacts also know each other, forming a closed loop. Closure lets a group notice, reward and gently correct behaviour, which is how norms form. (people who work with each other, not past each other), and with neighbours that can be tippedTipped teamA team in which most people now do the behaviour, so the team itself keeps it going and shows it to newcomers and to neighbouring teams. next. Not every team at once.
• Where does the security function sit? Attached to the backbone, at the edge of the network, not at its hub. If every champion's security conversations run through the security team, the security team is a cut-pointCut-pointA person or team whose removal would split the network into separate pieces. If the security function is a cut-point, nothing flows between champions without it. and the network has no shape of its own.
• Which bridges? Decide which seeded teams pair with which unseeded ones, and make sure some ties span departments rather than only teams within one. Behaviour that saturates a department and stops at its boundary is the common second-year pattern.

Where it goes wrong

• Designing by ratio. A roster that covers every unit with a single champion reaches everyone with news and nobody with behaviour.
• Letting the champion community become the network. A dense cluster of champions tied to each other and thinly to their teams carries awareness to its plateau and no further.
• A security function at the centre of everything, so that the network only works when security is in the room.

What good looks like

• The network is drawn before it is recruited: target teams, seed pairs or triads, and the bridges between teams.
• Every target team has two or three champions who know each other and are tied to most of the team.
• The backbone among champions is kept thin, for alerts and identity and nothing more.
• The security function is reachable from every champion but is not a cut-point of the network.

Across the stages

Go deeper

Why it matters

A call for volunteers recruits the people who already behave securely and already talk to the security team. They make excellent champions for the backbone. They are rarely the people a team watches. The champion who moves behaviour inside a team is the one colleagues already go to, and the only reliable way to find that person is to ask the team.

The decisions inside it

• Volunteer, nominated or assigned? Nominated by colleagues for the team seeds, chosen for position rather than interest in security. Volunteers for the backbone and the content work. Assigned champions only where a manager will stand behind the assignment, because a champion who was told to do it and whose manager forgot is a vacancy with a name.
• What is the selection test? Two questions put to the whole team: who do you go to when you are not sure about something at work, and who would you tell if you got a message you did not trust. The names that come back most often are the seeds. Security knowledge is not a criterion; it can be taught in a quarter, and position cannot.
• What does a champion agree to? A written agreement in plain terms: the hours per month, what the role is in this stage of the network, how long the term runs, and how to step back. A term with an end is easier to say yes to and easier to leave well.
• What does the manager agree to? The time, the recognition, and a line in the performance conversation. Recruit the manager before the champion; a champion recruited around their manager is lost at the first busy quarter.
• Singles, pairs or triads? Pairs at least, in every target team, chosen so that they already work together. A single champion sees the behaviour alone and is the first to drift.

Where it goes wrong

• A coverage drive that fills the roster with scattered singles. It reaches Stage 1 in months and sets up the second-year wall.
• Recruiting the already-converted and calling them influencers. Enthusiasm for security is the weakest predictor of influence over colleagues.
• No term and no exit, so champions drift away without anyone noticing, and the roster is a year out of date.

What good looks like

• Team seeds are chosen by colleague nomination for their position in the team.
• Every champion has a written agreement, and so does their line manager.
• Champions serve a fixed term with a choice to renew, step back or hand over.
• Every target team is seeded with at least a pair who already work together.

Across the stages

Go deeper

Why it matters

The role grows with the network, in three acts. The Recruit learns the ground and relays what the centre sends. The Influencer models the target behaviour inside their own team and raises it with colleagues one at a time. The Guardian holds the norm once the team has tipped and brings the next champion on. Expectations written for the first act are wrong for the second, and a programme that never rewrites them keeps its champions at the first.

The decisions inside it

• Which act, now? Write the role for the act the network is in, and say when it changes. Recruit at Stage 1, Influencer from Stage 3, Guardian at Stage 5. A champion who knows there is a second act does not mistake the first for the job.
• How many hours, spent where? Two to four hours a month is typical. The decision that matters is where they go: inside the team, in conversations and demonstrations, rather than in the champion channel. From Stage 3 the ratio should favour the team.
• What is a champion not? Not a help desk, not policy enforcement, and not the security team's eyes in the business. A champion who reports colleagues stops being someone colleagues go to, and the position that made them worth recruiting is gone.
• Who recognises them? The business, visibly: the manager, the team, the sponsor. Recognition that arrives only from the security team confirms that the champion works for security rather than for their team.
• What may they say and do on security's behalf? Write the escalation route and the limits down. Champions are more confident when the boundary is clear than when it is left to judgement.

Where it goes wrong

• Treating champions as a distribution list. Relaying content is the first act; a role that stays there is a newsletter with names attached.
• Expectations that never change as the network matures, so Stage 1 champions are asked Stage 3 questions and have no idea what is meant.
• Turning champions into informers, formally or by habit. It is the fastest way to lose the position in the team that you recruited them for.

What good looks like

• There is a written role for each of the three acts, and champions know which act they are in.
• Most champion time is spent inside their own team rather than in the champion community.
• Champions can say what they may and may not do on security's behalf, and where to escalate.
• Recognition reaches the manager and the team, not only the champion.

Across the stages

Go deeper

Why it matters

Most programmes train champions as junior security analysts and then wonder why colleagues do not change. The skill an Influencer needs is social: how to raise a behaviour with a colleague without preaching, how to show it rather than describe it, what to do when it goes wrong. Content from the centre is for the backbone. The behaviour is carried in person, by someone the team already listens to, with a few minutes a week to do it.

The decisions inside it

• What is the skills floor? A short set of competencies every champion reaches in their first quarter, drawn from the Skills Framework as a floor rather than a ceiling. Behavioural and conversational skills first; technical depth only where the champion's team needs it.
• What goes down the backbone, and what happens locally? Alerts and short briefs travel from the centre. Conversations, demonstrations and the small corrections that make a behaviour normal happen locally, and no amount of central content substitutes for them.
• Is the time real? Hours in the diary, agreed with the manager, visible to the team. A champion doing the role in their lunch break is doing it for a quarter at most.
• What is in the playbook? One per target behaviour: what to say, what to show, what good looks like in this team, what to do when a colleague pushes back, and where to log what reached whom.
• What tools do they need? A channel for the backbone, a playbook for each behaviour, and a place to record what they did in their team. The record is what the measurement component reads.

Where it goes wrong

• A content treadmill that measures itself by volume. The champions receive more than they can pass on, and the measure of success becomes what was sent.
• Training that makes champions knowledgeable and no more influential, because it never covered how to talk to a colleague about a behaviour.
• Enablement that only feeds the community: sessions champions enjoy, material colleagues never see.

What good looks like

• Every champion reaches an agreed skills floor in their first quarter, weighted to social and behavioural skill.
• There is a playbook for each target behaviour, written for a conversation rather than a presentation.
• Champion time is in the diary and agreed with the manager.
• Material and sessions can be traced to something that reached colleagues, not only champions.

Across the stages

Go deeper

Why it matters

The champion community is the most rewarding part of the programme to run, and it does the champions good: they know more, stay longer and speak up more. It also adds nothing to what reaches colleagues, because every tie it creates joins two people who have already adopted. Keep the community, because it holds the backbone together. Keep it thin, because the moment it becomes the champions' home, the teams have lost them.

The decisions inside it

• What is the backbone rhythm? A short regular contact that carries alerts and identity: a monthly call or a quarterly gathering, and an always-on channel kept quiet enough that champions read it. More is not better.
• Where does the energy go? Set the ratio between community time and team time, and from Stage 3 let the team win. If champions can name what they did in the community this month but not in their team, the ratio is wrong.
• What is the local rhythm? Each champion pair needs a routine inside the team: two minutes in the team meeting, a standing item, a monthly check on the behaviour. The local rhythm is what colleagues see; the backbone rhythm is what champions see.
• How much identity? A name, a badge, a small ritual. Enough that champions feel part of something, light enough that the something is not a club apart from the business.
• Who looks after the pairs? Pairs check in with each other, which is the simplest peer support there is and the reason to recruit in pairs.

Where it goes wrong

• The community as the destination. It is where the enthusiasm is, where the programme owner spends their time and where security feels at home, and investing in it feels like progress. It is not.
• Attendance as the headline metric. It rises with the community and says nothing about colleagues.
• A channel so busy it becomes a place to be rather than a place to check.

What good looks like

• There is a regular, light backbone rhythm for alerts and identity.
• Each champion pair has its own routine inside their team.
• Community measures (attendance, channel activity) are reported as secondary, never as the headline.
• Champions can say what they did in their own team this month.

Across the stages

Go deeper

Why it matters

Coverage, attendance and content are the measures a programme reaches for first, and they never fall when the behaviour line stays flat, which is why programmes report them forever. Count what reaches colleagues. Keep the raters apart (rater-disjointRater-disjointMeasures taken from different groups of people, so that no group is grading itself. The programme team, the champions and the champions' colleagues each supply a separate measure.): colleagues rate the behaviour they see in their own team, a network surveyOrganisational network surveyA short survey asking each person who they go to for advice, who they talk to about work, and who they would warn. The answers are turned into a map of the real working relationships in an organisation. reads the structure, and the programme team rates only its own capability. A programme that grades itself will pass.

The decisions inside it

• What are the three measures? A behaviour measure from colleagues, quarterly, independent of the champions. A network measure from a short survey and the champions themselves: embeddingChampion embeddingThe share of a champion's security-related conversations that happen inside their own team rather than with other champions or the security team. Low embedding is the signature of a champion cluster., exposure countsExposure countFor each person who has not yet adopted a behaviour, the number of their contacts who have. It is the direct test of whether the behaviour can start to spread to them., bridge widthBridgeThe ties that join one team to another. Bridge width is how many there are. A single tie is a narrow bridge: fine for news, too narrow for behaviour, which needs several ties into the next team before it can cross.. A programme measure from the programme leads, annually. Three sources, kept apart.
• When is the baseline taken? Before the first champion is recruited. A baseline taken after launch measures the launch.
• Which behaviour is measured directly? At least one of the target behaviours, from records rather than self-report: reports including false alarms, password manager uptake, requests paused and checked. Phishing click rate on its own is a measure of the simulation.
• What does the network survey ask? Three questions, once or twice a year: who do you go to for security advice, who would you tell about a suspicious message, who do you talk to about work. From the answers you read embedding, exposure and the bridges.
• Where is the programme on the model? Locate it against the gates of the maturity model and say so, including when the honest answer is Stage 2. The gates are non-compensatoryNon-compensatoryScoring in which strength in one area cannot make up for a gap in another. You must meet every gate at a stage to be at that stage. for a reason.
• What goes to the sponsor? The behaviour line first, the network measures second, the programme's own activity last.

Where it goes wrong

• A dashboard of coverage, attendance and content. It is a Stage 1 and 2 dashboard, and it will report success at the plateau for as long as it is used.
• No baseline, so the first result is also the comparison.
• Measuring what champions know and calling it culture. Champion knowledge is a measure of the community.

What good looks like

• A baseline was taken before the first champion was recruited.
• Colleagues rate the security behaviour they see in their own team every quarter, independent of the champions.
• A network survey reads embedding, exposure counts and bridge width at least once a year.
• The programme can name its stage on the maturity model and the gates it has met.

Across the stages

Go deeper

Why it matters

Champions leave, teams reorganise, the programme owner moves on and the first behaviour becomes ordinary. A network that depends on its champions to hold the norm is one restructure away from Stage 1. The design for the long run is the one in which a tipped team keeps the behaviour after its champions have gone and produces the next champion itself, so that the programme's work becomes maintenance and the next behaviour rather than this one.

The decisions inside it

• How long is a term? A year is common. At the end of it a champion renews, steps back or hands over, and the handover is planned rather than discovered. Rotation is a design choice, not a failure of retention.
• Where does the next champion come from? From a tipped team. A team that holds the behaviour already contains the people colleagues go to about it; recruiting from there costs nothing and a drive costs a quarter.
• What are the vital signs? Vacancy time per target team, embeddingChampion embeddingThe share of a champion's security-related conversations that happen inside their own team rather than with other champions or the security team. Low embedding is the signature of a champion cluster., retention, and drift of the behaviour measure in tipped teams. Set a floor for each and check them quarterly.
• What happens on a reorganisation? Write it down before it happens: which teams keep their pairs, where the bridges are re-drawn, and who checks the roster against the new org chart in the first month.
• When does the network move on? When the first behaviours hold without the champions, choose the next one and re-seed for it. The network is the asset; the behaviour is the current load.
• When does security step back? Deliberately, and visibly, to the edge of the network it built. If the programme owner leaves and the network stops, it was never self-sustaining.

Where it goes wrong

• Treating every departure as a loss instead of designing for rotation, so the programme spends its energy on retention and never on succession.
• A programme owner who is the single point of failure: the roster, the relationships and the history all in one person.
• Never moving on from the first behaviour, so the network carries something teams already hold and starts to feel pointless to the champions.

What good looks like

• A quarterly health check reads the vital signs against a floor for each.
• New champions have emerged from tipped teams without a recruitment drive.
• The behaviour has held in at least one team after its champions left.
• The next behaviour has been chosen and the network re-seeded for it.

Across the stages

Go deeper