How teams are running their Security Champions programmes with Heroes, and what they make of it. Longer use cases and shorter feedback, added as they come in.
We've got 172 awareness Champions across the business, and for a long time the whole thing ran on a spreadsheet. Who's a Champion, which team they're in, when we last heard from them, it was all in there. Then there were the distribution lists, a new form every time we ran something, and someone (usually me) copying the answers back into the spreadsheet afterwards.
None of it was difficult. There was just a lot of it, and every hour I spent on that was an hour I wasn't spending on the actual awareness work.
It's early days and I reckon we've taken about 30% off the admin already. Everything's in one place now: the Champions, their teams, what they've been up to, the events and who's signed up. If someone asks me a simple question, I can answer it without opening three different things first.
Honestly, this is the bit the Champions bring up. They can pop a quick update in from their phone between meetings and that's it, done. Before, they'd save it up for an email that never got written. So now we actually hear about what's going on.
I thought the calendar would just be somewhere to put dates. It's turned out to be more than that. Seeing the whole year in front of us made the quiet months really obvious, and we started asking what else we could do. Lunch and learns, guest speakers, things we'd just never thought about. The next six months are in there now.
We always sent a follow-up email after a session and got a few replies if we were lucky. After our first event in Heroes we got more feedback, and better feedback, and we used it to shape the next one. That's never really happened before.
With 172 people you can't keep it all in your head. Now I can see where the gaps are and which Champions are really carrying things. If I'm honest, I can also see the ones who aren't doing much. We won't rush it, but at some point we'll probably have a chat about swapping some of them for people who actually want the role.
Next year I'd like to look at how the network's put together: where the Champions sit, who they're connected to, and whether we've got them in the right places. For now, just being able to see the gaps is a big step for us.
“We used to just think about the next event. Now we've got six months planned out, and some of what's in there I'd never have thought of a year ago.”
“Getting the Heroes trial up and running was really easy. We'll come back with proper feedback once the trial's finished.”
“The Champions Health Check is a great tool. It was really easy to use, and the output was very detailed for a free tool. We now have an action plan to move our Defenders programme forward. Many thanks, and keep up the great work.”
“Thank you for providing the free health check. We ran it this week on our Champions and it helped identify where some gaps were in our thinking. We are now using this to make improvements. Thank you.”
Bring it to us. We'll show you where each column goes, and you can try Heroes free for 28 days.
Feedback A security practitioner on getting to grips with behaviour change.Site content · Sarah B., security practitioner