Starting a Security Champions network? Begin here.
You have been asked to build a Champions network, or you have decided the organisation needs one. Either way you are near the beginning, and there is a great deal of advice about. This page puts the three things you need in one place, in the order most people use them.
This is you if
- You have no network yet, or a handful of volunteers and no structure around them
- You need to understand the ideas properly before you explain them to anyone else
- Somebody senior still has to say yes
Three places to begin.
Most people work through them left to right. If you already know the ideas, go straight to the planner. If the only thing between you and a programme is a signature, start with the business case.
Understand the ideas
Three short reads that take you from why training alone stops working to what a well-run network looks like, then a blueprint of the network itself.
- Secure Behaviour Management 101
- Security Champions and Champions Networks
- The free book and the Network Blueprint
Plan your programme
The Champions Journey Planner walks you from the first conversation with a sponsor to an established programme, and remembers where you got to.
- Five stages, thirty-one actions
- Tick them off as you go
- Free, with nothing to sign up for
Build the business case
What to say to the people who hold the budget, in the order that tends to work, with wording you can lift straight into your own document.
- The 60-second pitch
- A one-page business case with costs and returns
- A 90-day plan a sponsor can say yes to
Not sure where to start? Let's talk it through.
Book a 30 minute video call and tell us where you are. We will help you work out what to do first, and show you how Heroes can support your programme if it fits.
Three reads, in this order. Then the blueprint.
Each one builds on the one before. Short of time? Read the first two and come back for the book when someone asks you a question you cannot answer. The blueprint at the end is the one to keep open while you plan.
- Secure Behaviour Management 101The primer. What SBM is, where the name came from, and why knowing what to do is not the same as doing it. COM-B, security fatigue, social norms and the other ideas the rest of this site leans on, in plain English and fully referenced.Read the primer →
- Security Champions and Champions NetworksThe role itself: who makes a good Champion, what they do in a normal week, and why a trusted colleague changes behaviour where a poster cannot. Then what you get when Champions are connected, coordinated and supported as one programme, and why that is the part that lasts.Meet the Champion →
- Get the book →
The Rise of the Security ChampionThe free ebook. Nine chapters on why Champions work and how to design, launch, measure and sustain a network. The planner follows it chapter by chapter, so the two are best used together. No sign-up needed. - The Security Champions Network BlueprintThe eight components every network is made of, the decisions inside each one, where it goes wrong and what good looks like. It is interactive: set the lens to the stage you are building, tick what you already have, and keep the report as the blueprint for your own programme.Open the blueprint →
Want to go further? The network models explain why where you place Champions matters more than how many you recruit, the Skills Framework sets out the 30 competencies the people running this work need, and the SHIELD Framework is the method a behavioural security programme follows once it is up and running.
Then plan it, one stage at a time.
The Champions Journey Planner turns the book into a checklist. Expand a stage, tick off each action as you finish it, and mark the stage complete to unlock the next. The first three stages are your first ninety days. The last two are what the programme becomes once it is running.
Your progress is saved in your browser, on this device. There is nothing to sign up for.
- Planning & Foundation 2 to 4 weeks
- Design & Recruit 3 to 6 weeks
- Launch & Develop 8 to 12 weeks
- Measure & Optimise Ongoing
- Scale & Sustain 12+ months
You are building Stage 1. Design it for Stage 3.
The Security Champions Maturity Model grades a programme by what its network can carry, not by how much it does. Getting started takes you from Stage 0, no network, to Stage 1, a roster with a route from the security team to every part of the business. That is the easiest step in the whole model and the planner gets you there in months. Alerts and content will reach every team, coverage will look good, and awareness will rise.
What the model adds is a warning about the step after that. Most programmes grow into a champion community (Stage 2) and then hit a wall, because a community of Champions, however good, does not change what reaches colleagues. The programmes that get over it have Champions embedded in pairs inside the teams whose behaviour needs to change (Stage 3). Three decisions in your first ninety days make that step a plan rather than a surprise.
Dotted terms show a short explanation when you point at them, or tap them on a phone.
Getting started covers Stages 0 and 1. The decisions below are what let you reach Stage 3 later by evolving what you built rather than starting again. The Network Blueprint sets all eight components against the model. Read the maturity model →
Recruit in pairs, not singles
One Champion in each of sixty teams spreads awareness and nothing else: no colleague ever sees more than one adopter. Two in each of thirty teams, who know each other, is where behaviour can start. Fewer teams covered, more teams that can tip.
See the reference model →Choose by position, not enthusiasm
Ask each team who they go to for advice and who they would tell about a suspicious message, and recruit those people. Volunteers are easier to find and harder to place; the colleague everyone already asks is the one whose adoption others see.
Why placement is everything →Count what reaches colleagues
Champions recruited, sessions held and content delivered are all measures of the network you built, and they keep looking good at the plateau. Decide now that you will also measure the behaviour colleagues observe in their own team.
How to measure a programme →Get the business behind it.
You know a Champions programme is the right thing to do. The people who hold the budget need to know it too. The business case page is the route from an idea to a sponsored, funded programme with a start date.
The 60-second pitch
The problem, why the usual answer has stopped working, what you propose and what you need. Ready to copy.
Read the pitch →Why Champions
Three things a network does that nothing else can, each with the line that lands with a board.
See the arguments →Business case and ROI
A one-page outline with what it costs on one side and what it returns on the other.
Use the outline →The 90-day plan
What will exist at day 30, 60 and 90. Sponsors say yes to plans with dates.
See the plan →
When you are ready to run it.
HEROES by CyBehave is the Security Champions platform. Everything in the planner has a home in it, and the trial is free for 28 days with no card.