How to measure a Security Champions programme
Count what reaches colleagues, not only what the programme does. Sooner or later someone senior asks what the Champions programme has changed. Most programmes answer with the numbers they have: Champions recruited, sessions held, attendance, content delivered. Those numbers are real, and they matter for running a network. But they describe the programme you built, not what it did, and they keep looking good long after the behaviour line has gone flat.
You are not alone in this. Forrester's 2026 research on Champions networks found that only 7% of organisations use dedicated tools to measure whether their programme reduces risk or changes behaviour. Most default to attendance and engagement figures.
This page sets out what to measure instead, who should supply each number, and how to report it so a sponsor can defend the programme when the easy numbers stop rising.
Three layers worth measuring
Every Champions programme can be measured at three layers. Most measure the first well, the second occasionally, and the third almost never. The third is the one a sponsor is really asking about.
What the programme does
Champions recruited and active, sessions held, tasks completed, retention over twelve months. These are the numbers you need to run the network week to week. They tell you whether the machine is working, not whether it is changing anything.
How the network is shaped
Coverage by team, site and function. How many Champions sit in each target team, and whether they know each other. How many of each Champion's security conversations happen inside their own team. Whether teams are bridged to their neighbours. Shape decides what the network can carry.
What reaches colleagues
The security behaviours people observe in their own team, and direct measures of the target behaviours themselves. This is the layer that shows the programme did something, and the one that justifies the investment.
Why the order matters. The first layer keeps rising at the plateau. The third only moves once the second has changed. That is why a programme reporting only the first layer can look healthy for years while behaviour stays exactly where it was.
Who supplies each number
The most common flaw in programme reporting is that one group supplies every number. When Champions report their own impact, or the programme team grades its own programme, the result is a view of the programme from inside it. Keep the sources apart, so nobody marks their own homework.
| Measure | Supplied by | How often | What it tells you |
|---|---|---|---|
| Observed behaviour in the team | Colleagues, about their own team, independent of the Champions | Quarterly | Whether anything has changed where the work happens |
| Direct measures of target behaviours | Systems: reporting tools, access logs, password manager adoption | Monthly or quarterly | Whether the specific behaviours are moving, without relying on what anyone says |
| Network shape | Champions, plus a short network survey of colleagues | At baseline, then each time the network is reshaped | Whether the network can carry behaviour, and where to recruit |
| Programme capability | Programme leads, assessing the programme against a structured model | Quarterly review, annual assessment | The programme's own view of its strengths and gaps, kept separate from the rest |
When colleagues, Champions and programme leads agree, the evidence is strong. When they disagree, the disagreement is itself useful: a programme that rates itself highly while colleagues see no change has found its next piece of work.
Choosing the behaviours to measure
You cannot measure behaviour change in general. You measure a short list of named behaviours, agreed with your sponsor before the first quarter starts.
Name three at most for the first year, and make at least one of them a behaviour that costs something. Knowing where the report button is spreads on its own. Reporting routinely, including false alarms, pausing on an urgent request that carries authority, or giving up a shared credential all cost time or carry social risk. People adopt those only once several colleagues around them have. They are the reason a network exists, and they are the behaviours worth tracking.
For each one, decide how you will see it directly rather than asking people whether they do it. Report rates and response times come from the reporting tool. Credential sharing shows up in access data and password manager adoption. Where no system shows the behaviour, colleagues' observation of their own team is the next best source.
What to measure at each stage
What counts as progress depends on where the programme is. The Security Champions Maturity Model grades a network by what it can carry, and each stage has its own measures.
| Stage | What the network looks like | What to measure |
|---|---|---|
| 1 Roster | Champions recruited, hub and spoke | Coverage; message reach |
| 2 Community | Champions have a channel and a community of their own | Capability; retention; attendance |
| The wall: a change of structure, not of effort | ||
| 3 Embedded | Pairs or threes inside target teams | Embedding; exposure counts; teams that have tipped |
| 4 Bridged | Change spreading between teams and departments | Bridge width; tipped teams per department; time for a neighbour to tip |
| 5 Self-sustaining | Teams hold the norm when a Champion leaves | Persistence after departure; new Champions emerging from tipped teams |
The step from Stage 2 to Stage 3 is where measurement has to change. Stage 1 and 2 measures can be read from programme records. Stage 3 and beyond need a measure of the network itself and of what reaches colleagues. Reshaping the network usually lowers coverage, so agree with your sponsor in advance that the coverage figure will fall, and why.
Running a network survey
You do not need specialist software to see the shape of your network. A short survey asking every colleague in scope three questions is enough.
- Who do you go to for security advice?
- Who would you tell about a suspicious message?
- Who do you talk to about work?
From the answers you can read off which Champions colleagues actually turn to, which teams have no one, how many of each Champion's ties sit inside their own team, and which teams are bridged to others.
Run it before you reshape the network and again afterwards, alongside a direct measure of the target behaviour. A spreadsheet and a network analysis library will do the rest.
The Network Blueprint sets out measurement and evidence as one of the eight components every network needs, and the network models explain what each shape can carry.
Reporting to your sponsor each quarter
A sponsor who sees a coverage slide twice a year will defend the coverage number. A sponsor who sees the behaviour line every quarter can defend the programme. Keep the report to one page, in this order.
If the coverage figure falls because you have moved Champions into target teams, say so on the page, with the reason. Explained in advance, it reads as a plan. Discovered by the sponsor, it reads as decline. For the case that gets a programme funded in the first place, see the business case.
- The behaviour line. Each named behaviour, as colleagues observe it and as the systems show it, against last quarter and the baseline.
- Teams that have changed. Which target teams have tipped, and which have not yet.
- The shape of the network. Champions in each target team, the gaps, and where you plan to recruit next.
- What the programme did. One line of activity figures. They belong in the report, just not at the top.
- What happens next, and what you need. The next quarter's focus, and any decision or support you need from the sponsor.
Six ways measurement goes wrong
1Grading by activity
A programme that reports coverage, attendance and content is reporting what its network can carry at Stages 1 and 2, and will go on reporting it, because those numbers do not fall when behaviour stays flat.
2One group supplying every number
Champions rating their own impact, or the programme team grading its own programme, produces a view from inside. Keep the sources apart.
3Relying on self-report
Asking people whether they behave securely measures what they think they do. Pair it with colleague observation and system data.
4Promising a ratio to the board
You will need to change it when the network is reshaped, and the promise becomes the thing you are measured against.
5Treating the community as the result
A lively Champion community is good for the Champions. It does not, on its own, change what reaches their colleagues.
6A purpose that reads "raise awareness"
Awareness is what the network carries in its first year whatever you do. It is not something to measure success by.
Three measures, three separate sets of eyes.
HEROES by CyBehave is built around the measurement on this page. Each of its three measures is drawn from a different group of people and kept apart from the others, so nothing is counted twice and no score is folded into another.
Behaviour Index
as observed by colleagues, not by Champions
Colleagues rate the security behaviours they observe in their own team through the quarterly Team Pulse, independent of the Champions and the training platform. It measures what the network carried, not what the programme did. This is the outcome measure.
Core platform, from day oneProgramme Capability
as assessed by your programme and security team
The programme's own view of how well it is run, kept deliberately separate, with the full history of every measure and a test that separates a real movement from noise.
Measure & Evidence · available nowNetwork Strength
as reported by your Champions
How capable, connected and far-reaching the network is, with network analysis showing who bridges teams, who is isolated, and where the next recruit would help most.
Network Optimisation · in developmentThe reasoning behind keeping the sources apart is set out in the Research Lab.
Questions about measuring a Champions programme
What is the best single measure of a Security Champions programme?
The security behaviour colleagues observe in their own team, measured every quarter by people other than the Champions. On its own it is not enough, but it is the measure that comes closest to answering whether the programme changed anything.
How often should you measure?
Track the programme's activity continuously, colleague observation every quarter, and the shape of the network at baseline and again whenever you reshape it. A full programme assessment once a year is enough for most programmes.
Can you measure a Champions programme without a platform?
Yes. A short survey, the data your reporting tools already hold, a spreadsheet and a network analysis library will cover all three layers. A platform saves the time it takes to run that every quarter, and keeps the sources apart for you.
Why does coverage fall when a programme matures?
Because behaviour change needs Champions in pairs or threes inside the teams whose behaviour is the target. Concentrating them means fewer teams have a Champion, even though more teams can change. Agree that trade with your sponsor before you make it.
What is the difference between awareness and behaviour measures?
Awareness measures what people know, such as whether they recognise a phishing lure. Behaviour measures what they do, such as whether they report it, every time, including the false alarms. Awareness usually rises in a programme's first year. Behaviour moves later, and only when the network is shaped to carry it.
Sources and further reading
- Forrester, Four Things You Should Know About Security Champions Networks, August 2026.
- CyBehave, The Security Champions Maturity Model.
- CyBehave, Network models for Security Champions.
- CyBehave, The Security Champions Network Blueprint.
- CyBehave, The Rise of the Security Champion, free ebook.
How does your programme measure up?
The free Champions Programme Health Check scores your programme across six dimensions, including measurement, and names the one holding the rest back. About ten minutes, with a PDF report and no email address needed.