The Security Champions platform.

Heroes is the platform for running a Security Champions programme: recruit and coordinate your Champions, develop them, and measure whether the behaviour around them is changing. It is built on behavioural science, without you or your Champions needing to be behavioural scientists. Start with the base platform and add capability as your programme matures.

Start free trial → Is it for me?
Your programme, your name
Don't call them Security Champions?
Security Ambassadors Cyber Guardians Security Advocates

Rename the role to match your culture. Heroes adapts every label across the platform - so it speaks your organisation's language.

Who it is for

Built around the people who run Champions programmes.

Most people recognise themselves in one of these. Each one shows what Heroes gives you from day one, and where an add-on module takes you when the programme is ready for it.

The founder

Setting up a programme from nothing

You have been asked to build a Champions programme, have never run one, and are doing it alongside everything else. You need something credible in place within a quarter.

From day oneBase: guided setup, your first cohort recruited and onboarded, a baseline captured, and a business case template to secure sponsorship.
The coordinator

Running a network from Outlook, a list and a Teams channel

You have a working network, or have inherited one. You need to know who is active, who is drifting, where the gaps are, and to stop losing track.

From day oneBase: tasks with completion tracking, events with attendance, an engagement calendar, and a status view of leaders, laggers and coverage by team.
The awareness lead and the CISO

Being asked what has actually changed

Completion is high, click rates have plateaued, and the board wants to know what the programme has changed rather than what it has delivered.

From day oneBase: the Behaviour Index, measured by colleagues from day one.
Add-on module · in developmentMeasure & Evidence: Programme Capability, trend with reliable-change testing across every measure, and a scheduled board pack.
The security team

Living with risks and incidents

Your programme exists because of an incident, and you need to record the next one, see the pattern, and know which behaviour to work on because of it.

From day oneBase: priority behaviours and the interventions to move them.
Add-on module · available nowRisk & Incidents: a risk register and heatmap, incident register tied to behaviours, and threat intelligence for Champions.
The group programme manager

Scaling across sites, countries and cultures

You run a network that spans divisions or countries. Coverage rests on a few people, and you cannot see where the next recruit would make the most difference.

From day oneBase: the Champion influence map and coverage by team, site and function.
Add-on module · in developmentNetwork Optimisation: who bridges teams, who is isolated, single-link coverage risk, and recruitment targeting from the gaps.
The behavioural specialist

Wanting the full method, not a summary of it

Your network is already behaviour-led. What you lack is instrumentation, and every tool you are offered was built for a compliance team.

From day oneBase: the guided designer and the Behaviour Index, in plain language.
Add-on module · in developmentBehavioural Science: the complete SHIELD designer, COM-B diagnosis, the framework vocabulary, and every measure with its construction shown.
Grows with your programme

The base platform runs the programme. Modules take it further.

Every subscription starts with Base, which has everything a programme needs to recruit and coordinate Champions, change behaviour, and prove it. As your programme matures you may want to go deeper on evidence, network analysis, behavioural method, or risk. That is what the add-on modules are for. Risk & Incidents is available now and the rest are in development, and you are never paying for capability you cannot yet use.

Included with every subscription

Base

For the founder and the coordinator, and everything a Champion touches.

Base is the whole platform for running a network: recruit and coordinate Champions, develop them, design and run interventions, and measure whether behaviour is changing. A programme that buys nothing else can still change behaviour and show it, through the Behaviour Index. Network Strength and Programme Capability arrive with the modules that build on it.

Run the network
  • Champion management, coverage map and status view
  • Tasks, events and engagement calendar
  • Comms builder with AI review
  • Recognition, Champion of the Month and journeys
Change behaviour
  • Priority behaviours chosen from the behaviour catalogue
  • Guided designer: from naming a behaviour to scaling what worked
  • Training Academy
  • Nudge, the AI guide, on hand for every role
Prove it
  • The Behaviour Index: security behaviour as observed by colleagues, measured every wave
  • The instruments: the peer pulse, Champion check-ins and the Champion influence map
  • Maturity survey and security team assessment
  • Reports in plain language, six languages
Add-on modules

Each module is designed for a point a programme reaches, not a point it starts at. Risk & Incidents is available now; the other three are in development.

In development

Measure & Evidence

For the awareness lead and the CISO.

Adds Programme Capability, the composite measure of how well the programme is run, then trends, analyses and evidences change across every measure in a form a board will act on.

What it adds
  • Programme Capability: a composite measure of programme strength, assessed by your programme and security team
  • Trend every measure over time with reliable-change testing, and break the Behaviour Index down by team and site
  • Drill from any measure to the behaviour and the item behind it, to see exactly what improved
  • Import your programme history, so a mature network carries its track record with it
  • The full maturity profile: a capability level per dimension, and the steps to the next level
  • Scheduled board packs, audit-mapped evidence packs, and consent-gated peer benchmarking
In development - module page to follow
In development · requires Measure & Evidence first

Network Optimisation

For the inheritor and the group programme manager.

Adds Network Strength, the composite measure of the network, and builds on the influence map Base captures: see the shape of your network in detail and target the recruits that will strengthen it most. Works on the data Measure & Evidence collects, so it is added alongside that module.

What it adds
  • Network Strength: a composite measure of the network, reported by the Champions themselves
  • Interactive network analysis: who bridges teams, who is isolated, and whose position carries a message furthest
  • Network density, and where the next recruit would strengthen coverage the most
  • Succession planning and single-link coverage risk, so the network outlasts any one person
  • Champion 360 feedback from the colleagues each Champion supports
  • Recruitment targeting drawn from the gaps, so every new Champion adds reach
In development - module page to follow
In development

Behavioural Science

For the behavioural specialist.

The complete behavioural method and the workings behind every score, for the practitioner who wants the full toolkit.

What it adds
  • The complete eight-step SHIELD designer, with wave rollout and gates between waves
  • The COM-B diagnostic with its primer and per-component scoring
  • Change-wheel matching, argued rather than assumed, with the technique library in full
  • A prediction committed before launch, and the retrospective against it
  • The framework vocabulary - COM-B, the Behaviour Change Wheel, APEASE - across every screen, switchable on or off
  • Every measure with its full construction shown: signals, declared weights, what was withheld and why, plus instrument health and raw export under consent
In development - module page to follow
Available now

Risk & Incidents

For the security team.

Bring risk and incident management into the programme, so what happens on the ground shapes which behaviours you work on next.

What it adds
  • Risk register, dashboard and heatmap, with reporting open to Champions and the whole workforce
  • Incident register tied to behaviours, with a review queue
  • A recommended response for each incident: priority, campaign or intervention
  • Threat intelligence written by your team, with a Champion feed and logged briefings
  • Risk handling added to the Programme Capability measure
  • Available from day one, for programmes that started with an incident
Learn more about Risk & Incidents →

Module names and contents are being finalised during early testing and may change. See Heroes pricing.

Platform Features

Everything your programme needs.

One platform for the full Champion lifecycle - from onboarding and training through to board-level reporting and programme maturity.

🔄

Champion Lifecycle Management

End-to-end management of every Champion, from the moment they are recommended through onboarding, active contribution, and a graceful offboarding.

🗼

Coverage Map & Heatmap

Visualise Champion coverage across divisions, departments, and geographies. The engagement heatmap shows activity across six dimensions with exportable reports so gaps are visible at a glance.

📊

Behavioural Heartbeat

Three times a year, Champions capture short outside-in feedback from their teams on security behaviours and maturity. Combined with monthly Champion check-ins, Behavioural Heartbeat gives you continuous visibility of your security culture - verifiable data to design, execute, and measure interventions.

📡

Threat Intelligence

Your security function writes intelligence in plain, non-technical language and tags it Technical, Operational, Strategic or Business. Champions subscribe to the categories that matter to their teams, then run briefing actions to make colleagues aware of a live threat. Human-authored, not an automated feed.

🧪

Intervention Designer

A guided five-step workflow to design Behaviour Change Wheel-aligned interventions. Diagnose COM-B deficits, select matched techniques, build weekly action plans, and measure impact.

🎓

Training Academy

A multi-module tiered curriculum covering behavioural science, communication psychology, critical thinking, and programme leadership. Role-specific paths with certificates and downloadable summaries.

🏆

Journeys, Tasks & Gamification

Assign behaviour change tasks from a curated library and link them to Champion development journeys. XP, five-tier progression, badges, a leaderboard, and Champion of the Month reward progress - evidence-based gamification that motivates without creating unhealthy competitive pressure.

💬

Comms Builder

A behavioural comms builder with AI review, psychological safety analysis and specificity checking, so Champions and the programme team send messages that land and prompt action.

🤖

Nudge AI Guidance Assistant

Always-on behavioural guidance built into every page. Nudge helps Champions design interventions, supports Programme Teams in reading data, and guides every new user through the platform grounded in COM-B throughout.

⏱

20-30 Minutes a Week

Champions are volunteers with day jobs. Heroes is built around a 20-30 minute weekly rhythm - short tasks, bite-sized learning, and quick check-ins that fit around existing commitments. Sustainable engagement is how Champion programmes survive beyond year one.

Nudge AI

Your always-on behavioural guide.

Nudge is built into every corner of CyBehave Heroes. Grounded in the COM-B model and CyBehave research, it is a genuine behavioural guide available to Champions, Programme Teams, and Programme Leaders around the clock.

Intervention guidanceNudge helps Champions identify COM-B gaps in their team, suggests relevant techniques from the library, and guides them through building a practical intervention plan.
Programme intelligenceProgramme Teams can ask Nudge to interpret coverage gaps and recommend targeted actions grounded in real programme data. Nudge knows which wave is open and how old each reading is, so it will not narrate behaviour movement between publishes, will not describe a change smaller than measurement error as a change, and will not tell you one measure caused another.
Platform guidance and toursNew users are greeted with a guided tour. Every context help icon across the platform opens Nudge with a plain-language explanation of that feature.
Anonymous programme insightsProgramme Teams see aggregated, anonymised themes from champion guidance conversations, with no individual attribution.
Daily limits and controlsProgramme Leaders can configure daily message limits per role, enabling or disabling AI chat for Champions and Programme Team independently. Guided tours and context help are always available regardless of AI chat settings.
Nudge is AI-powered and may occasionally need adapting to your context. Always apply your own professional judgement. Conversations are used anonymously in aggregate form to improve the Nudge experience.
NUDGE
Included with every CyBehave Heroes subscription
Champion AI chat✓ Included
Guided tours & context help✓ Always on
Programme Team insights✓ Included
The Science

Behaviour change, not just awareness.

Most security culture programmes stop at awareness. Heroes uses the COM-B model and Behaviour Change Wheel to diagnose why people behave the way they do - then designs interventions that last.

These models are put to work through SHIELD, CyBehave's six-stage behavioural change framework built purely for cybersecurity. Every Heartbeat reading, task, and intervention in the platform maps back to a SHIELD stage and a COM-B component, ensuring your programme effort is always directed at the right lever.

The full SHIELD method will be available through the Behavioural Science module, currently in development. The base platform carries a simplified version of it, built into the guided designer, so behaviour change follows a scientific methodology from day one without you needing to be a behavioural scientist.

Read the science → Explore SHIELD →
Capability

The physical and psychological ability to perform secure behaviours. Skills, knowledge, and the cognitive function to apply them under pressure.

Opportunity

The environment that makes secure behaviour the easy, default choice. Social norms, tools, processes, and the absence of unnecessary friction.

Motivation

The reflective intentions and automatic habits that drive secure behaviour. Incentives, beliefs, identity, and emotional responses to risk.

SHIELD runs Specify, Hypothesise, Intervene, Embed, Learn, and Diffuse as one continuous cycle, with sustainment engineered into every turn. Heroes is that cycle as working software: each stage has a home in the platform.

Specify

Define observable target behaviours during programme setup, prioritised by the risks that matter to your organisation.

Hypothesise

Champion Check-Ins and Team Pulse diagnose which COM-B component is holding a behaviour back.

Intervene

The Intervention Designer matches evidence-based techniques to the diagnosis before anything reaches delivery.

Embed

Champions carry interventions into their teams, backed by tasks, comms, and recognition in the flow of work.

Learn

Dashboards track behaviour and its drivers against baseline, so you know what worked and what to revisit.

Diffuse

Network analysis shows where Champion coverage is strong enough to scale what the evidence validated.

Built for everyone

You do not need to be a behavioural scientist.

Most people running a Champions network do not come from behavioural science or cyberpsychology, and should not need to. So the base platform keeps the jargon to a minimum: plain, everyday language on every screen, with the science working underneath. The language only starts to shift when you enable advanced modules such as Behavioural Science.

Base platform

Plain language, by default

Every screen speaks in clear, everyday terms. Run check-ins, design interventions, and read your dashboards without needing to know the theory underneath. The platform does the behavioural science for you, and keeps it out of your way.

  • No jargon, no learning curve
  • Guidance written for busy volunteers
  • Ready to use from day one
Advanced modules

Behavioural depth, when you enable it

Modules like Behavioural Science bring the terminology, the models and research behind each feature, and exactly how every measure is derived and weighted. Advanced wording is a setting in your profile, so the practitioner sees the full method while everyone else keeps the plain version.

  • COM-B and Behaviour Change Wheel language throughout
  • The research and models behind each metric
  • How scores are derived and weighted, made transparent
Measurement

Three measures. Three separate sets of eyes.

Most platforms hand you three scores built from the same data, which is really one number shown three times. Heroes asks three different groups of people, so each score stands on its own. The Behaviour Index comes from the colleagues who work alongside your teams, is the one outcome measure, and is part of Base. Network Strength is reported by your Champions and comes with Network Optimisation. Programme Capability is assessed by your programme and security team and comes with Measure & Evidence. Behavioural Science shows how each is built. Nothing is counted twice, and no score is folded into another.

Programme Capability
0/ 100

What the programme has in place to work with: leadership, resources and delivery.

100% of the evidence this measure uses

as assessed by your programme and security team
Network Strength
0/ 100

How capable, connected and far-reaching your Champion network is.

100% of the evidence this measure uses

70 respondents

as reported by your Champions
Behaviour Index
Outcome
0/ 100

Secure behaviour actually observed in teams. This is the outcome measure.

67% of the evidence this measure uses

Read 2 days ago

as observed by colleagues, not by Champions

Because the three scores come from different people, we never fold one into another, and we never claim one caused another. A stronger programme leading to a stronger network, and a stronger network leading to better behaviour, is something you can watch for in your own data rather than something we have baked into the maths. Every score opens into a longitudinal view with its full signal breakdown (through the Measure and Evidence module), exports to a spreadsheet, and always carries the date it was taken and how much of its evidence was actually there.

What we will not claim yet. After a few surveys we can tell a real change from normal wobble in your own numbers. Comparing your scores against other organisations needs data we simply do not have, so we do not pretend to. And proving the programme caused a change, rather than it happening anyway, takes a very specific kind of rollout. We are honest about where you are on that path rather than claiming more than the evidence supports.

Training Academy

A modular curriculum built in.

The Training Academy gives your team access to the scientific methods and frameworks that underpin the Heroes platform - without requiring anyone to become a behavioural scientist. Each module is short and focused, bringing the key concepts to life through practical examples relevant to your security programme. Every module ends with a downloadable summary you can print out and refer back to, so learning stays accessible long after the session is complete.

Champions, security teams, and programme leaders each see the modules relevant to their role - building a shared language and evidence-based approach across the programme without overwhelming anyone with theory. The modules available reflect the platform capabilities you have purchased: Base comes with the curriculum that supports it, and each add-on module brings its own training with it.

Foundation

Core frameworks

COM-B and Behaviour Change Wheel foundations, dual-process theory (System 1 and 2), communication psychology, and critical thinking. Designed to be accessible to anyone - no prior scientific knowledge required.

Intermediate

Role-specific paths

Champion skills and team engagement, intervention design, programme management, measurement and evaluation, and social network analysis. Modules match each role's practical day-to-day needs.

Advanced

Strategic capability

Organisational culture and resistance to change, strategic reporting and programme maturity, and choice architecture. Each module includes a downloadable PDF summary to keep and refer back to.

Specialist Journeys are available for Champions who want to go deeper - self-enrol in optional pathways like Trusted Advisor or Risk Reporter to earn unique badges and develop specialist skills. As with the Academy, the Journeys on offer reflect the platform capabilities you have purchased.

New to Champions?

Why Security Champions?

Heroes is the platform - but the idea it serves is bigger. If Security Champions are new to you, start with why peer-led programmes change behaviour where top-down training cannot, and how to build a network from your first recruit.

Security Champions →

What Champions are, the role they play across people, process and technology, and why they are your most important security investment.

Building a Champions network →

A practical, staged journey for standing up a Champions programme - from identifying the right people to a self-sustaining network.

Ready to build your Champions programme?

28-day free trial. No credit card required. Base in full from day one, and you add a module when you are ready.

Start free trial → Talk to us about Enterprise