The first year of a champions programme feels like success. The second feels like a wall. Most programmes get stuck at stage two of five, working harder at what got them there, and none of it will get them over.
Your Security Champions programme probably stopped working about a year ago. You probably haven't noticed, because every number you report still looks healthy.
I mean that literally. The champions are there. The channel is busy, the monthly call is well attended, retention is good, and coverage is close to one in every team. Awareness scores went up and stayed up. What did not move is the thing the programme was set up for: what people outside the champion group do when a request looks wrong, when a password needs sharing to hit a deadline, when reporting a false alarm means looking jumpy in front of the team.
That flat line is the wall. Most programmes I would call mature stand at the foot of it, and most respond by running at it harder.
Five stages, and where the wall sits
The Security Champions Maturity Model grades a programme by one thing: what its network can carry from the champions to everyone else. It does not grade activity, governance or good intentions, because those are the measures that keep reporting success while behaviour stays still.
|
Stage |
Name |
What it looks like |
What it carries |
|---|---|---|---|
|
0 |
Absent |
A few informal contacts. Nothing designed. |
Nothing |
|
1 |
Roster |
A named champion per team, each tied to the security function. Champions do not know each other. |
Alerts and content |
|
2 |
Community |
Champions have a channel, a regular meeting and an identity of their own. |
Awareness, at its ceiling |
|
The wall |
|||
|
3 |
Embedded |
Two or three champions inside each target team, chosen for their position in it. |
Behaviour, inside those teams |
|
4 |
Bridged |
Behaviour crosses from seeded teams to their neighbours and between departments. |
Behaviour, across the organisation |
|
5 |
Self-sustaining |
Teams hold the norm when the champion leaves. New champions appear without a recruitment drive. |
Behaviour, without depending on champions |
Stage 1 takes months. Stage 2 takes another year or so and is the most enjoyable work in the whole programme. Then progress stops, and it stops for a structural reason.
Why Stage 2 is a limit
Information and behaviour spread differently. Hearing something once is enough to know it. That is how an alert travels, and a hub-and-spoke roster carries it to every team in two hops.
Behaviour that costs something is different. Mark Granovetter described it in the 1970s as a threshold: each of us adopts once enough of the people around us already have. Damon Centola later tested this in a controlled experiment and found that a behaviour spread further and faster through tightly clustered groups, where people received the same signal from several contacts, than through networks of scattered long-range links. One colleague doing the secure thing is an oddity. Three colleagues doing it is how we work here.
Now look at what a Stage 2 programme has built. It has taken one person from each team and tied them closely together. The reinforcement that behaviour needs exists, and it exists among the people who have already adopted. Back in the team, each colleague still sees exactly one champion.
We simulated this to make the claim exact: 1,200 employees in sixty teams of twenty, with sixty champions placed as each stage prescribes. For a behaviour that needs three reinforcing contacts, the results were these.
|
Network |
Share of the organisation that adopts |
|---|---|
|
Stage 1, Roster |
6% |
|
Stage 2, Community |
6% |
|
Stage 3, Embedded |
73% |
|
Stage 4, Bridged |
95% |
Stage 1 and Stage 2 are identical. All the investment in the champion community, every session, every newsletter, every awards evening, added nothing to what reached colleagues. It made better champions. It did not make a network that could carry behaviour. And the same sixty people, placed differently, took adoption from 6 per cent to 73.
A caution, because the numbers are striking. This simulation is built from standard models with plausible parameters. It shows how the mechanism works. It is not yet field evidence from a real organisation.
Why running at the wall does not work
When the behaviour line goes flat, the natural response is more. More content, more events, more champions, a bigger community. Every one of those is more Stage 2, and the model says it moves nothing.
It also feels like progress, which is the trap. The champion community is where the enthusiasm is. It is where the programme owner spends their time and where the security function feels welcome. The numbers it produces never fall. A programme can report rising attendance and full coverage for five years while standing in the same place.
The wall changes shape. You don't get over it through effort.
How to get over it
Find out where you are, honestly. The gates are all-or-nothing. A brilliant community with no embedding is Stage 2. Three questions will tell you. Does each team you care about have at least three champions who know each other? Do most of each champion's security conversations happen inside their own team, or with other champions? Has any team visibly changed a costly behaviour, measured by something other than a champion survey? If the answer to any of those is no, you are below the wall.
Pick one behaviour and a few teams. Do not restructure the whole programme. Choose one behaviour that costs people something, such as reporting routinely, including the false alarms, or pausing on an urgent request from someone senior. Choose five or six teams where it matters most.
Put three champions in each team. Choose them by position, not enthusiasm. Ask the team who they go to when something looks odd and who they would tell first. Those are your champions, whether they volunteered or not. They need to know each other and be connected to most of the team.
Thin the community to a backbone. Keep the channel for alerts and for identity. The champions' time belongs in their teams.
Change what you count. Stop counting what reaches champions and start counting what reaches colleagues. How many people in a team can see more than one colleague doing the behaviour? Which teams have tipped? That needs a short survey and a direct measure of the behaviour.
Warn your sponsor before you start. Coverage will fall, because you are concentrating champions where they can do something. If the board has been shown coverage for two years, that drop needs explaining in advance. Tell them what you expect instead: awareness will not change, behaviour will, and it will change first in the teams you seeded.
The uncomfortable part
None of this is as pleasant as what came before. You are trading a warm community for the resistance of ordinary teams, and a number that always goes up for one that might not. That is why so many programmes stay where they are.
But a Stage 2 programme is an awareness channel with a nice social calendar. If that is what you want, keep it, and stop promising behaviour change. If you were asked for behaviour, the wall is the job.
The full maturity model sets out every stage, gate and transition, and the free Champions Programme Health Check gives you a first read on where you stand in about ten minutes.
Sources
- Wood, A. (2026). A Security Champion maturity model: Carrying capacity, the awareness plateau and the wall between simple and complex contagion. Working paper. SSRN preprint.
- Centola, D. (2010). The spread of behavior in an online social network experiment. Science, 329(5996), 1194-1197.
- Centola, D. and Macy, M. (2007). Complex contagions and the weakness of long ties. American Journal of Sociology, 113(3), 702-734.
- Granovetter, M. (1978). Threshold models of collective behavior. American Journal of Sociology, 83(6), 1420-1443.