Start with clarity on what you want to achieve:
- What specific security behaviours need to improve?
- What security outcomes matter most?
- How will you measure success beyond activity metrics?
- What realistic timeline are you working with?
You know a Champions programme is the right thing to do. The people who hold the budget need to know it too. This is the route from an idea to a sponsored, funded programme with a start date: six steps, in the order they tend to work.
Executives decide whether to keep listening in the first minute. The pitch has to say what the problem is, why the usual answer has stopped working, what you are proposing instead, and what you need. Nothing else.
Use the version opposite as it is, or adapt the three shorter forms for the corridor, the email and the one-line answer to "what is this about?"
Most of our security incidents start with something a person did or did not do. We have trained everyone, and completion is high, but the behaviour has not changed. Training tells people what to do. It does not change what they do when nobody is watching.
What changes behaviour is the people around us. I want to build a small network of Security Champions: trusted colleagues in each team who make secure behaviour normal where they work. It costs them twenty to thirty minutes a week. It costs us a coordinator's time and a platform to run it.
In ninety days I can have the first cohort recruited, a baseline measured, and the first behaviour we are targeting agreed. In a year I can show you whether behaviour has moved, measured by the people who work alongside them. I need a sponsor, a decision on the platform, and permission to ask twenty people.
A Security Champion is a member of the workforce, not the security team, who takes on a voluntary peer-facing role. A network is what you get when those people are connected, coordinated and supported as one programme. These are the arguments that land with leadership.
People adopt behaviours because of the people around them: social proof, trust and peer modelling. Training raises awareness; a trusted colleague in the room changes what people actually do. Champions are the mechanism through which peer-led behaviour change operates at scale.
A security team cannot be in every meeting or every decision. A Champion in engineering, finance, HR and operations means security thinking is present when the work is being done, not bolted on at the edges after the fact.
A network with structure produces data: who is active, which teams are covered, what colleagues observe, and whether behaviour is moving. That turns the annual "we did the training" report into a trend the board can act on.
Want the longer version? Read What is a Security Champion? and What is a Champions Network?
A Champions programme is unusually cheap for what it does, and the business case should make that visible. Put the honest cost of people's time next to what an incident costs and what the programme measures, and let the reader do the arithmetic.
Use the outline opposite as the structure of your document. Keep it to one page for the decision, with detail in appendices for whoever asks.
Follow our proven, step-by-step journey from planning to mature security culture. Track your progress and master each phase - your progress saves automatically in your browser.
Five stages, thirty-one actions. Stages 1 to 3 are your first ninety days (step 5 below maps them to a calendar); stages 4 and 5 are what the programme becomes once it is running. Expand a stage, tick off actions as you complete them, and mark it complete to unlock the next.
Before launching your programme, you need executive buy-in, a clear business case, and an understanding of why Security Champions succeed where traditional approaches fail. This phase sets you up for long-term success.
Start with clarity on what you want to achieve:
Secure genuine executive sponsorship (not just approval) by:
Understand your real context:
Design a network structure that fits your organisation's reality, recruit Champions who will actually engage, and define clear roles without overengineering.
Choose a coverage model that matches your organisation:
Key decision: start small (5-15 Champions) and scale from learning.
Look for Champions who have:
Champions need to know what is expected:
Launch with energy, build Champion capability through community (not just training), and establish sustainable engagement patterns before the initial excitement fades.
Your launch sets the tone for everything:
Focus on progression, not perfection:
Create sustainable cadences:
Build credible measurement frameworks, demonstrate value to different stakeholders, and use data to improve your programme continuously.
Avoid vanity metrics - focus on meaningful indicators:
Different stakeholders need different evidence:
Use measurement to improve, not just report:
With a proven foundation, scale thoughtfully, embed Champions in organisational culture, and prepare for the future of security Champions work.
Grow based on success, not enthusiasm:
Make Champions part of how you work:
Adapt to emerging trends:
Sponsors say yes to plans with dates. This is the first three stages of the planning tool above laid out on a calendar: what will exist at each checkpoint, and which stage to be working through to get there. Adapt the numbers to your organisation, but keep the order: sponsor before recruitment, baseline before intervention.
Stage 3 of the planner runs on past day 90, and stages 4 and 5 (Measure & Optimise, Scale & Sustain) are the programme once it is established. Back to the planning tool to tick off what you have done.
CyBehave Heroes is the Security Champions platform. Every step in the 90-day plan has a home in Base, the platform every subscription starts with, and the measurement that makes your business case credible is built in from day one. As the programme matures, planned add-on modules take it further.
Champion management, tasks, events and an engagement calendar, with a coverage map that shows the sponsor which teams are covered.
The peer pulse and Champion check-ins give you a baseline in the first quarter and three measures from three separate groups thereafter.
Priority behaviours from the catalogue and a guided designer that follows a scientific method, without you needing to be a behavioural scientist.
Talk to us. We have helped people get programmes sponsored in organisations of every size, and we are happy to read a draft.