Getting started

Starting a Security Champions network? Begin here.

You have been asked to build a Champions network, or you have decided the organisation needs one. Either way you are near the beginning, and there is a great deal of advice about. This page puts the three things you need in one place, in the order most people use them.

This is you if

You have no network yet, or a handful of volunteers and no structure around them
You need to understand the ideas properly before you explain them to anyone else
Somebody senior still has to say yes

Three places to begin.

Most people work through them left to right. If you already know the ideas, go straight to the planner. If the only thing between you and a programme is a signature, start with the business case.

1Learn

Understand the ideas

Four short reads that take you from why training alone stops working to what a well-run network looks like.

Secure Behaviour Management 101
Security Champions and Champions Networks
The free book

Start learning ↓

2Plan

Plan your programme

The Champions Journey Planner walks you from the first conversation with a sponsor to an established programme, and remembers where you got to.

Five stages, thirty-one actions
Tick them off as you go
Free, with nothing to sign up for

Open the planner →

3Make the case

Build the business case

What to say to the people who hold the budget, in the order that tends to work, with wording you can lift straight into your own document.

The 60-second pitch
A one-page business case with costs and returns
A 90-day plan a sponsor can say yes to

Build the case →

1Learn

Four reads, in this order.

Each one builds on the one before. Short of time? Read the first two and come back for the rest when someone asks you a question you cannot answer.

Want to go further? The network models explain why where you place Champions matters more than how many you recruit, the Skills Framework sets out the 30 competencies the people running this work need, and the SHIELD Framework is the method a behavioural security programme follows once it is up and running.

2Plan

Then plan it, one stage at a time.

The Champions Journey Planner turns the book into a checklist. Expand a stage, tick off each action as you finish it, and mark the stage complete to unlock the next. The first three stages are your first ninety days. The last two are what the programme becomes once it is running.

Open the planner →

Your progress is saved in your browser, on this device. There is nothing to sign up for.

Planning & Foundation 2 - 4 weeks
Design & Recruit 3 - 6 weeks
Launch & Develop 8 - 12 weeks
Measure & Optimise Ongoing
Scale & Sustain 12+ months

On the maturity model

You are building Stage 1. Design it for Stage 3.

The Security Champions Maturity Model grades a programme by what its network can carry, not by how much it does. Getting Started takes you from Stage 0, no network, to Stage 1, a roster with a route from the security team to every part of the business. That is the easiest step in the whole model and the planner gets you there in months. Alerts and content will reach every team, coverage will look good, and awareness will rise.

What the model adds is a warning about the step after that. Most programmes grow into a champion community (Stage 2) and then hit a wall, because a community of Champions, however good, does not change what reaches colleagues. The programmes that get over it have Champions embedded in pairs inside the teams whose behaviour needs to change (Stage 3). Three decisions in your first ninety days make that step a plan rather than a surprise.

Dotted terms show a short explanation when you point at them, or tap them on a phone.

Stage 0AbsentNo network. A few informal contacts in the business.

Stage 1RosterChampions recruited against a ratio. Hub and spoke. Carries alerts and content.

Stage 2CommunityChampions have a channel and a community of their own. Awareness at its plateau.

Stage 3EmbeddedPairs or triads inside target teams. The first behaviour lines move.

Stage 4BridgedTipping crosses from seeded teams to neighbours and across departments.

Stage 5Self-sustainingTeams hold the norm when a champion leaves. New champions emerge from tipped teams.

Carries simple contagion: awarenessCarries complex contagion: behaviour

Getting Started covers Stages 0 and 1. The decisions below are what let you reach Stage 3 later without rebuilding. Read the maturity model →

Decision 1

Recruit in pairs, not singles

One Champion in each of sixty teams spreads awareness and nothing else: no colleague ever sees more than one adopter. Two in each of thirty teams, who know each other, is where behaviour can start. Fewer teams covered, more teams that can tip.

See the reference model →

Decision 2

Choose by position, not enthusiasm

Ask each team who they go to for advice and who they would tell about a suspicious message, and recruit those people. Volunteers are easier to find and harder to place; the colleague everyone already asks is the one whose adoption others see.

Why placement is everything →

Decision 3

Count what reaches colleagues

Champions recruited, sessions held and content delivered are all measures of the network you built, and they keep looking good at the plateau. Decide now that you will also measure the behaviour colleagues observe in their own team.

How to locate a programme →

3Make the case

Get the business behind it.

You know a Champions programme is the right thing to do. The people who hold the budget need to know it too. The business case page is the route from an idea to a sponsored, funded programme with a start date.

Step 1