Get the business behind a Security Champions programme.

You know a Champions programme is the right thing to do. The people who hold the budget need to know it too. This is the route from an idea to a sponsored, funded programme with a start date: six steps, in the order they tend to work.

Begin with the pitch → Use the planning tool
1The 60-second pitch

Say it in a lift, not a slide deck.

Executives decide whether to keep listening in the first minute. The pitch has to say what the problem is, why the usual answer has stopped working, what you are proposing instead, and what you need. Nothing else.

Use the version opposite as it is, or adapt the three shorter forms for the corridor, the email and the one-line answer to "what is this about?"

Most of our security incidents start with something a person did or did not do. We have trained everyone, and completion is high, but the behaviour has not changed. Training tells people what to do. It does not change what they do when nobody is watching.

What changes behaviour is the people around us. I want to build a small network of Security Champions: trusted colleagues in each team who make secure behaviour normal where they work. It costs them twenty to thirty minutes a week. It costs us a coordinator's time and a platform to run it.

In ninety days I can have the first cohort recruited, a baseline measured, and the first behaviour we are targeting agreed. In a year I can show you whether behaviour has moved, measured by the people who work alongside them. I need a sponsor, a decision on the platform, and permission to ask twenty people.

One lineWe have trained everyone and behaviour has not changed. Champions change behaviour where it happens, and we can measure it.
The corridorOur incidents are mostly human. Training alone has plateaued. I want twenty trusted people across the business to make secure behaviour normal in their teams, and a way to prove it worked. It is cheap and I can start in ninety days.
The email subject lineA ninety-day plan to turn security training into security behaviour
2Why Champions

Three things a Champions network does that nothing else can.

A Security Champion is a member of the workforce, not the security team, who takes on a voluntary peer-facing role. A network is what you get when those people are connected, coordinated and supported as one programme. These are the arguments that land with leadership.

It changes behaviour, not just knowledge

People adopt behaviours because of the people around them: social proof, trust and peer modelling. Training raises awareness; a trusted colleague in the room changes what people actually do. Champions are the mechanism through which peer-led behaviour change operates at scale.

For the board: the human factor in incidents is addressed at the point where behaviour happens.

It puts security inside every team

A security team cannot be in every meeting or every decision. A Champion in engineering, finance, HR and operations means security thinking is present when the work is being done, not bolted on at the edges after the fact.

For the board: coverage of the whole organisation without growing the security headcount.

It gives you evidence, not activity

A network with structure produces data: who is active, which teams are covered, what colleagues observe, and whether behaviour is moving. That turns the annual "we did the training" report into a trend the board can act on.

For the board: a measurable line on security culture, three times a year.

Want the longer version? Read What is a Security Champion? and What is a Champions Network?

3The business case and ROI

One page. Costs on one side, what you get on the other.

A Champions programme is unusually cheap for what it does, and the business case should make that visible. Put the honest cost of people's time next to what an incident costs and what the programme measures, and let the reader do the arithmetic.

Use the outline opposite as the structure of your document. Keep it to one page for the decision, with detail in appendices for whoever asks.

What it costs

  • Champion time: 20 to 30 minutes a week, per Champion
  • Coordinator time: a share of one person's week
  • A platform licence for the base capability
  • A sponsor's visible support, twice a quarter

What it returns

  • Fewer incidents that start with a person, in the teams covered
  • Faster reporting of the ones that do happen
  • Security present in decisions before they are made
  • A measured trend in behaviour the board can see
On the numbers: use your own. Your incident history, your loaded hourly cost, and your team count are the figures a finance director will trust. Multiply Champion time by your cost per hour to get the honest programme cost, and set it against the cost of the last incident that started with a click.

The one-page business case

  1. The problem in one paragraphWhat share of your incidents start with a person, and what the last one cost. Your numbers, not an industry statistic.
  2. Why the current approach has plateauedTraining completion, phishing click rate, and the fact that neither has moved in the last year.
  3. What you are proposingA Security Champions network: how many people, which teams first, what they will do each week, and who coordinates it.
  4. What it costsChampion hours, coordinator time, platform licence. One total, per year.
  5. What success looks likeThree to five specific, measurable goals. Behaviour observed by colleagues, coverage of teams, reporting rates.
  6. How you will measure itA baseline in the first quarter, then a reading three times a year, from people who are not the Champions.
  7. The 90-day planWhat will exist at day 30, 60 and 90. Step 5 below gives you the plan.
  8. What you needA named sponsor, a decision on the platform, and permission to recruit the first twenty.
4The planning tool

Build your Security Champions programme.

Follow our proven, step-by-step journey from planning to mature security culture. Track your progress and master each phase - your progress saves automatically in your browser.

Five stages, thirty-one actions. Stages 1 to 3 are your first ninety days (step 5 below maps them to a calendar); stages 4 and 5 are what the programme becomes once it is running. Expand a stage, tick off actions as you complete them, and mark it complete to unlock the next.

0Stages
Completed
0Actions
Done
0%Journey
Progress
I am working on:
🚀
New Programme
Starting from scratch
🔄
Existing Programme
Reignite a stalled network
Ready to begin? Expand Stage 1 below to start your Champions journey. Each stage unlocks as you complete the previous one.
🚀
Current Phase
Getting Started
Ready to begin your Security Champions journey? Start with the planning phase to lay a solid foundation.
1
Planning & Foundation
Lay the groundwork for sustainable success
⏰ 2 - 4 weeks 🎯 6 key actions

Before launching your programme, you need executive buy-in, a clear business case, and an understanding of why Security Champions succeed where traditional approaches fail. This phase sets you up for long-term success.

🎯 Define Your Goals

Start with clarity on what you want to achieve:

  • What specific security behaviours need to improve?
  • What security outcomes matter most?
  • How will you measure success beyond activity metrics?
  • What realistic timeline are you working with?
💼 Build Your Business Case

Secure genuine executive sponsorship (not just approval) by:

  • Quantifying the cost of security incidents
  • Demonstrating how Champions reduce risk at scale
  • Showing realistic resource requirements
  • Connecting to existing business priorities
🏢 Assess Your Organisation

Understand your real context:

  • Organisational structure and team distribution
  • Existing security initiatives and their reputation
  • Available resources and constraints
✓ Key actions to complete
Document your programme goals and success criteria
Write down 3-5 specific, measurable goals
Build a business case presentation
Include cost-benefit analysis and risk reduction metrics
Identify and approach your executive sponsor
Schedule meeting and prepare your pitch
Map your organisational structure
Identify teams, locations, and potential Champion coverage
Define resource requirements
Time, budget, tools, and support needed
Secure executive sponsorship
Get formal commitment and visible support
📚 For detailed guidance see Chapters 1-3 in The Rise of the Security Champion
2
Design & Recruit
Build your Champions network structure
⏰ 3 - 6 weeks🎯 8 key actions
🔒

Design a network structure that fits your organisation's reality, recruit Champions who will actually engage, and define clear roles without overengineering.

🏗 Structure Your Network

Choose a coverage model that matches your organisation:

  • Team-based (1-2 Champions per team)
  • Geography-based (office/location coverage)
  • Technology-based (per platform/stack)
  • Hybrid approach (combination of above)

Key decision: start small (5-15 Champions) and scale from learning.

🎯 Recruit the Right People

Look for Champions who have:

  • Natural curiosity about security
  • Trust and respect within their teams
  • Communication skills (not necessarily technical depth)
  • Time and manager support
  • Motivation to help others
📋 Define Roles Clearly

Champions need to know what is expected:

  • Core responsibilities (must-do activities)
  • Optional activities (when they have time)
  • Realistic time commitment
  • Boundaries (what they do not do)
  • Support available from security team
✓ Key actions to complete
Choose your network structure model
Document coverage approach and target size
Create Champion role description
Include responsibilities, time commitment, benefits
Develop recruitment materials
Emails, presentation for team leaders
Launch recruitment campaign
Open applications and solicit nominations
Interview and select candidates
Assess motivation, availability, fit
Confirm manager support
Ensure Champions have time and backing
Announce your founding Champions
Make it visible and celebratory
Set up communication channels
Meetings schedule, shared documentation space
📚 For detailed guidance see Chapter 4 in The Rise of the Security Champion
3
Launch & Develop
Build capability and create momentum
⏰ 8 - 12 weeks🎯 11 key actions
🔒

Launch with energy, build Champion capability through community (not just training), and establish sustainable engagement patterns before the initial excitement fades.

🚀 Launch Strong

Your launch sets the tone for everything:

  • Host a kickoff event (virtual or in-person)
  • Executive sponsor makes visible commitment
  • Set clear expectations and celebrate Champions
  • Make it feel important and exciting
📚 Build Capability

Focus on progression, not perfection:

  • Aware to Engaged to Contributing to Leading
  • Create spaces for peer learning
  • Focus on real problems, not generic training
  • Celebrate small wins publicly
🔄 Establish Rhythms

Create sustainable cadences:

  • Monthly Champion meetings (or async updates)
  • Regular one-to-one check-ins
  • Quarterly reviews and planning
  • Ongoing recognition (not just annual)
✓ Key actions to complete
Plan and execute launch event
Include executive sponsorship and clear programme vision
Create onboarding materials
Welcome pack, resources, quick-start guide
Establish meeting rhythm
Schedule first 3 months of Champion touchpoints
Build knowledge repository
Wiki, FAQ, or shared documentation space
Conduct one-to-one check-ins
Meet each Champion individually in first month
Define first quarter objectives
Small, achievable goals for early momentum
Establish recognition approach
How you will celebrate Champion contributions
Create feedback mechanisms
How Champions share challenges and suggestions
Document early wins
Track and share quick successes
Complete 3-month milestone review
Assess what is working, adjust what is not
Assess current security culture
Survey teams or conduct informal interviews
📚 For detailed guidance see Chapter 5 in The Rise of the Security Champion
4
Measure & Optimise
Demonstrate value and improve continuously
⏰ Ongoing🎯 6 key actions
🔒

Build credible measurement frameworks, demonstrate value to different stakeholders, and use data to improve your programme continuously.

📊 Measure What Matters

Avoid vanity metrics - focus on meaningful indicators:

  • Champion engagement (not just head count)
  • Capability development over time
  • Team-level security behaviour changes
  • Programme sustainability metrics
  • Qualitative impact stories
💬 Demonstrate Value

Different stakeholders need different evidence:

  • Executives: business risk reduction, ROI
  • Security team: reduced burden, better coverage
  • Champions: personal growth, recognition
  • Managers: team capability improvement
🔄 Continuous Improvement

Use measurement to improve, not just report:

  • Regular Champion feedback surveys
  • Quarterly programme reviews
  • Testing new approaches
  • Learning from other organisations
✓ Key actions to complete
Define your core metrics
5-7 key indicators that actually matter
Build measurement processes
How and when you collect data
Create stakeholder reports
Tailored dashboards or updates for each audience
Conduct 6-month programme review
Comprehensive assessment with Champion input
Document lessons learned
What worked, what did not, why
Implement improvements
Act on feedback and data insights
📚 For detailed guidance see Chapters 6-7 in The Rise of the Security Champion
5
Scale & Sustain
Mature your programme for long-term success
⏰ 12+ months🎯 Ongoing mastery
🔒

With a proven foundation, scale thoughtfully, embed Champions in organisational culture, and prepare for the future of security Champions work.

📈 Scale Thoughtfully

Grow based on success, not enthusiasm:

  • Expand to new teams and locations deliberately
  • Use existing Champions as mentors
  • Maintain quality over speed
  • Document scaling playbooks
🌿 Embed in Culture

Make Champions part of how you work:

  • Champions involved in onboarding new hires
  • Security Champion role in career paths
  • Integration with engineering practices
  • Champions shaping security strategy
🔮 Future-Proof Your Programme

Adapt to emerging trends:

  • AI and automation impact on Champion work
  • Distributed and remote team considerations
  • Evolving security threats and practices
  • Building programme resilience
📚 For detailed guidance see Chapters 8-9 in The Rise of the Security Champion
5The 90-day plan

What will exist at day 30, 60 and 90.

Sponsors say yes to plans with dates. This is the first three stages of the planning tool above laid out on a calendar: what will exist at each checkpoint, and which stage to be working through to get there. Adapt the numbers to your organisation, but keep the order: sponsor before recruitment, baseline before intervention.

Days 1 to 30
Planner stage 1 · Planning & Foundation

Sponsor, scope and structure

  • Named executive sponsor, with two dates in their diary
  • Three to five programme goals written down
  • Coverage model chosen: by team, site or function
  • First behaviour to target agreed
  • Platform decided and set up
At day 30: a programme exists on paper with a sponsor behind it.
Days 31 to 60
Planner stage 2 · Design & Recruit

Recruit and baseline

  • First cohort recruited: ten to twenty, chosen for trust, not technical depth
  • Manager agreement for each Champion's time
  • Onboarding and the first Champion meeting
  • Baseline measured, from colleagues in covered teams
  • Champion check-in captured
At day 60: real people are in the programme and the starting line is drawn.
Days 61 to 90
Planner stage 3 · Launch & Develop

First intervention and first report

  • First intervention designed against the target behaviour
  • Champions running it in their teams
  • Engagement calendar agreed for the next two quarters
  • Coverage map and first status view shared with the sponsor
  • Date set for the first follow-up measurement
At day 90: the programme is running, visible, and has a date on which it will show a result.

Stage 3 of the planner runs on past day 90, and stages 4 and 5 (Measure & Optimise, Scale & Sustain) are the programme once it is established. Back to the planning tool to tick off what you have done.

6Deliver it with Heroes

The plan above is what the base platform is built to run.

CyBehave Heroes is the Security Champions platform. Every step in the 90-day plan has a home in Base, the platform every subscription starts with, and the measurement that makes your business case credible is built in from day one. As the programme matures, planned add-on modules take it further.

Recruit and coordinate

Champion management, tasks, events and an engagement calendar, with a coverage map that shows the sponsor which teams are covered.

Baseline and measure

The peer pulse and Champion check-ins give you a baseline in the first quarter and three measures from three separate groups thereafter.

Design and run interventions

Priority behaviours from the catalogue and a guided designer that follows a scientific method, without you needing to be a behavioural scientist.

Start free trial → Explore Heroes Base platform and modules

Stuck on the business case?

Talk to us. We have helped people get programmes sponsored in organisations of every size, and we are happy to read a draft.