Security champion programmes are widely recommended and rarely measured in a way that separates what the programme did from what it changed. Most report activity: champions recruited, sessions run, tasks completed. The Champions Programme Health Check is a free eighteen-item diagnostic answered by the person who runs the programme. It scores practice across six dimensions, from purpose and sponsorship through to measurement and impact, identifies the dimension holding the rest of the programme back, and returns a score out of 100 with a named band and three actions aimed at that constraint. This note sets out why a champion programme needs its own instrument, where the six dimensions come from, what the assessment reports, and what it does not yet claim. It should be read alongside the CyberShield Resilience Assessment, which covers the wider behaviour programme, and the preprint describing how Heroes measures the same programme from three separate rater populations.
Why a champion programme needs its own instrument
The CyberShield Resilience Assessment asks how a whole security behaviour programme is run. A champion programme is a narrower thing: a structure of volunteers placed in teams the security function does not manage, with its own sponsorship, recruitment, enablement and measurement problems. Practitioner guidance treats such a network as a standard feature of a mature awareness function. The SANS maturity model lists a champion or ambassador network as a step towards long-term culture change, and the OWASP Security Champions Guide sets out ten principles for running one (OWASP, n.d.; SANS Institute, n.d.). Neither offers a measurement framework.
The research literature does not fill the gap. What has been published on champions is small, mostly qualitative and concentrated in software engineering, and to our knowledge no peer-reviewed study has measured the effect of a champion programme on wider workforce behaviour using observed or controlled outcome data (Wood, 2026). The nearest evaluation found that apprentices trained as champions changed their own practice and that little of it reached their colleagues, because the organisation had not put in place the support for it to spread (Menges et al., 2023). A programme lead asked whether the programme is working has, in most cases, nothing better to offer than a list of what it has done.
The Health Check is a first step towards something better. It does not measure behaviour, and it says so. It measures the practice of the programme, which is the thing the programme lead can answer for, in a form that makes the weakest part visible rather than averaged away.
Theoretical basis
The six dimensions are drawn from the practitioner and research literature on what makes a champion programme hold together, and they are ordered roughly as a programme is built.
Purpose and sponsorship asks why the programme exists, who stands behind it, and whether champions have the time and money to do the job. Allocated time, a defined role and visible management support are the conditions most consistently named in the action research on champions in software teams (Jaatun & Cruzes, 2021), and vision and management support head the OWASP principles.
Recruitment and coverage asks who the champions are, how they were chosen, where they sit and what happens when they leave. The strongest practice recruits against informal influence rather than volunteering alone, and knows which parts of the organisation have a champion and which do not. Becker et al. (2017) argued that champions should act as bottom-up agents who surface where policy fails, which is only possible where they are placed deliberately.
Enablement asks how champions are prepared: onboarding, skills and the materials they are given to work with. The advocate literature describes the role as a mix of technical knowledge, interpersonal skill and service orientation, with trust and plain explanation ahead of fear (Haney & Lutters, 2021). A programme that recruits well and prepares badly produces champions who are present and silent.
Engagement asks whether champions are active, connected to each other and recognised for what they contribute. Community and recognition are two of the OWASP principles. The design distinguishes activity that is recorded from activity that is assumed, because a programme scored on its activity will produce activity (Goodhart, 1984; Muller, 2018).
Network and influence asks whether champions change anything in their teams and whether information flows both ways. The dimension rests on a distinction from network science: information spreads as a simple contagion, where one contact is enough, while costly or socially risky behaviour spreads as a complex contagion that needs reinforcement from several contacts (Centola & Macy, 2007). A young network moves information. A mature one is trying to change behaviour, and the practice that supports each is different.
Measurement and impact asks what the programme measures, where the evidence comes from and who gets to see it. The anchor is Kirkpatrick's observation that reaction and learning are easy to evaluate, behaviour and results are hard, and organisations stop at the first two (Kirkpatrick & Kirkpatrick, 2006). The strongest practice measures something the programme does not itself produce.
Two further commitments shape the items. Anchors describe what the organisation does, not how good the respondent thinks it is, because self-assessment drifts upward and a ladder of states gives two honest people a better chance of landing on the same answer (Dunning et al., 2004). And the headline result is the constraint, following the theory of constraints (Goldratt & Cox, 1984): the throughput of a programme is set by its weakest dimension, and the useful output of an assessment is the identity of that dimension rather than the mean across all six.
What the assessment asks
The Health Check has eighteen items, three for each of the six dimensions. Every item presents five descriptions of practice ordered from Absent, through Ad hoc, Basic and Managed, to Exemplary, and the respondent selects the one closest to current practice rather than the one they are working towards. The anchors are behavioural, in that they describe what the programme does, which is what makes them answerable without a scale of agreement and harder to answer aspirationally.
Before the questions, the respondent gives five pieces of context: sector, organisation size band, region, the age of the programme and the number of champions. The last two matter because a programme six months old with twelve champions and a programme six years old with four hundred should not be read against the same expectations, and because they allow the benchmark to be cut by programme stage once the sample permits.
Scoring and the constraint dimension
Each dimension receives a normalised score and an overall score out of 100 is reported alongside a named band. The constraint dimension is the dimension with the lowest score, presented on the results screen as a named dimension with an explanation of why it limits the others, together with three actions aimed at it, before the respondent is offered anything else. The overall score is compensatory in the ordinary way, and we say so: it is there because a single number is what gets a programme onto an agenda. The constraint dimension is the diagnostic, and the three actions are the point of the exercise.
The full report downloads as a PDF and reproduces the six-dimension profile, the constraint and the actions, so that it can be put in front of a sponsor without the respondent having to transcribe it.
Benchmarking
Answers are stored anonymised with sector, size band and region so that programmes can be compared with their peers. Programme age and champion count are held for the same purpose. A comparison is only meaningful once a cell contains enough programmes to say something, so it is designed to appear as the sample grows rather than to be shown against a handful of early respondents.
Data handling
No email address is required to take the Health Check or to receive the result. The organisation's name is never requested, and nor is the respondent's. What is stored is the set of answers, the dimension scores, and the five context fields, with nothing that identifies a person or an organisation. The full privacy notice is in the CyBehave Trust Centre.
Where it sits beside Heroes
The Health Check is self-report by a single respondent, and that is its most important limit. The preprint describing the measurement model in Heroes (Wood, 2026) sets out why a programme cannot be measured well from one vantage point: the people who report on a programme are the people who run it, and composites built from one set of raters correlate whatever the world does. Heroes draws its three headline measures from three disjoint populations. Programme capability is read from the programme and the security team; network strength from champions' monthly check-ins and interaction maps; behaviour from an anonymous peer instrument answered by team members who are not champions, gated on whether the respondent was in a position to observe the behaviour at all.
The Health Check corresponds to the first of those vantage points, the programme's view of itself, and deliberately claims nothing beyond it. It asks about practice because practice is what the programme lead can speak to. It does not ask the respondent to rate the behaviour of the teams the programme is trying to change, because a champion programme rating the behaviour of those teams is rating its own work. Where the Health Check reports a constraint at network and influence or at measurement and impact, those are precisely the dimensions Heroes exists to measure from somewhere other than the programme itself.
What the Health Check does not yet do
The Health Check is a designed instrument, not a validated one, and it should be read that way. It is self-report by a single respondent, usually the person running the programme, and inherits the optimism that brings. The six-dimension structure is motivated by the literature rather than confirmed by it: we have not yet run item analysis, reliability estimation or factor analysis on real submissions, and the band cut-offs were set by expert judgement and will be revisited once the sample allows. The benchmark sample is small and self-selected towards programmes whose leads are already thinking about measurement. Nothing in the result is evidence that the programme has changed anyone's behaviour, and nothing in it should be presented to a board as if it were.
None of these limitations affects the central claim. The constraint dimension and the three actions are implemented as described, and a strong score in one dimension cannot hide a weak one.
What comes next
The validation path runs through Heroes. A Health Check completed by a programme lead can be compared with the independently sourced measures Heroes produces for the same organisation: the security team's assessment of the programme, champions' own reports of confidence and reach, and the peer-observed behaviour index. That comparison is the convergent validity test the instrument needs, and it is also the test of whether a programme's view of itself predicts anything about the network it has built or the behaviour around it. The preprint's literature review found no study of that relationship. The two instruments together are positioned to supply one.
We will publish item statistics and the benchmark distribution once the real sample is large enough to report without identifying anyone.
References
- Becker, I., Parkin, S., & Sasse, M. A. (2017). Finding security champions in blends of organisational culture. In Proceedings of the 2nd European Workshop on Usable Security (EuroUSEC 2017). Internet Society. https://doi.org/10.14722/eurousec.2017.23007
- Centola, D., & Macy, M. (2007). Complex contagions and the weakness of long ties. American Journal of Sociology, 113(3), 702–734. https://doi.org/10.1086/521848
- Dunning, D., Heath, C., & Suls, J. M. (2004). Flawed self-assessment: Implications for health, education, and the workplace. Psychological Science in the Public Interest, 5(3), 69–106. https://doi.org/10.1111/j.1529-1006.2004.00018.x
- Goldratt, E. M., & Cox, J. (1984). The goal: A process of ongoing improvement. North River Press.
- Goodhart, C. A. E. (1984). Problems of monetary management: The UK experience. In Monetary theory and practice (pp. 91–121). Macmillan. https://doi.org/10.1007/978-1-349-17295-5_4
- Haney, J. M., & Lutters, W. G. (2021). Cybersecurity advocates: Discovering the characteristics and skills of an emergent role. Information & Computer Security, 29(3), 485–499. https://doi.org/10.1108/ICS-08-2020-0131
- Jaatun, M. G., & Cruzes, D. S. (2021). Care and feeding of your security champion. In 2021 International Conference on Cyber Situational Awareness, Data Analytics and Assessment (CyberSA) (pp. 1–7). IEEE. https://doi.org/10.1109/CyberSA52016.2021.9478254
- Kirkpatrick, D. L., & Kirkpatrick, J. D. (2006). Evaluating training programs: The four levels (3rd ed.). Berrett-Koehler.
- Menges, U., Hielscher, J., Kocksch, L., Kluge, A., & Sasse, M. A. (2023). Caring not scaring: An evaluation of a workshop to train apprentices as security champions. In Proceedings of the 2023 European Symposium on Usable Security (pp. 237–252). ACM. https://doi.org/10.1145/3617072.3617099
- Muller, J. Z. (2018). The tyranny of metrics. Princeton University Press.
- OWASP. (n.d.). OWASP Security Champions Guide. OWASP Foundation. https://securitychampions.owasp.org/
- SANS Institute. (n.d.). Security awareness maturity model. https://www.sans.org/security-awareness-training/resources/maturity-model/
- Wood, A. (2026). Rater-disjoint measurement of security champion programme maturity and readiness: Design and rationale of an instrumented platform [Preprint, version 1]. CyBehave Ltd. CC BY 4.0.
Cite this note
CyBehave Lab. (2026). Counting champions is not measuring them: the design of the Champions Programme Health Check. CyBehave Lab. https://cybehave.com/lab/champions-health-check