01
You run a working network, or have just inherited one, from Outlook, a SharePoint list and a Teams channel. Some Champions are active, some have quietly stopped, and nobody is sure which teams still have one. You are not being asked about behaviour change. You need to run the network well and stop losing track.
How Heroes supports this · Base and Risk & Incidents are available now; other named modules are in development
1
Base
Bring the network in as it is
Import your Champions with their teams and sites. If it is three hundred names and forty active people, that is fine: the first thing Heroes shows you is the difference.
2
Base
Run tasks and events from one place
Give Champions something to do, see who has done it, chase the rest. Schedule the monthly meeting and track who turned up. This replaces the spreadsheet rather than adding to it.
3
Base
Read the status view
Coverage by team or site, and who is active, so a part of the organisation going quiet is visible early, not when the network has gone quiet.
4
Base
Keep the rhythm going
Recognition, Champion of the Month and the engagement calendar keep people involved without you having to write a reminder email every week.
Capabilities involved
Champion management
Tasks and events
Engagement calendar
Coverage map
Status view
Recognition
The key insight: A coordinator can run a network in Heroes for years without ever opening a network graph. Every operational feature is also quietly collecting the data that answers the harder questions when someone eventually asks them.
What this achieves
One place instead of four Tasks, events, feedback and status replace the inbox, the list, the channel and the document.
Drift caught early Decliners and coverage gaps are visible before they become a dead network.
Evidence collecting itself When someone asks whether the network is having an effect, the answer is already being assembled.
Ideal for: Awareness coordinators and programme managers running a live network who want to run it well.
02
Your network works. Completion is high, Champions share content and staff the stand in October, and your CISO or board has started asking a harder question: what has any of this changed? Activity reports are not landing any more, and you need evidence of behaviour, not delivery.
How Heroes supports this · Base and Risk & Incidents are available now; other named modules are in development
1
Base
Measure behaviour from the people who see it
Three times a year, colleagues rate the security behaviours they observe in their own team. That is the Behaviour Index: independent of your training platform and independent of the Champions themselves, and part of Base from day one.
2
Measure & Evidence
Add the programme view
Programme Capability, a composite measure of how well the programme is run, assessed by you and your security team. Network Strength, reported by the Champions themselves, comes with Network Optimisation. Each measure says plainly what it is based on and when it is being withheld.
3
Measure & Evidence
Trend it and test it
Trend every measure over time with reliable-change testing, so you can say a shift is real and not normal wobble. Break the Behaviour Index down by team and site so growth is visible where it happened.
4
Measure & Evidence
Put it in front of the board
Scheduled board packs to people who never log in, evidence packs mapped to an audit framework, and the full maturity profile with the steps to the next level.
Capabilities involved
Peer pulse
Behaviour Index
Programme Capability
Trend and reliable change
Board pack
Evidence packs
The key insight: The people best placed to say whether behaviour has changed are the colleagues who work alongside a Champion every day. Heroes asks them, and keeps that answer separate from every other signal so it cannot be argued away.
What this achieves
A number the board will accept A Behaviour Index built from what colleagues observe, not self-reported by the people being measured.
Real change told apart from noise Reliable-change testing on your own history, in your own numbers.
Evidence that arrives on its own Board packs on a schedule, in the form your audit framework expects.
Ideal for: Awareness leads and CISOs who need to move the conversation from what was delivered to what changed.
03
Click rates have flattened. Training completion is fine and has been for two years. The programme is doing everything the vendor catalogue suggests and nothing is moving. You suspect the problem is not awareness at all, but you do not have a way to find out what it is.
How Heroes supports this · Base and Risk & Incidents are available now; other named modules are in development
1
Base
Name the behaviours that matter
Choose priority behaviours from the catalogue rather than topics from a calendar, and baseline each one through the peer pulse and Champion check-ins.
2
Base
Design against the diagnosis
The guided designer takes you from a named behaviour to a running intervention in eight steps, with a stated expected effect, so every intervention is a test rather than a guess.
3
Base
Let Champions run it locally
Interventions are delivered by the people with credibility in each team, with tasks, comms and recognition in the flow of work.
4
Behavioural Science
Go deeper when you want to
The COM-B diagnostic, change-wheel matching, a prediction committed before launch and the retrospective against it, for the point where you want the full method and its workings.
Capabilities involved
Priority behaviours
Peer pulse
Guided designer
Champion journeys
COM-B diagnostic
Predictions and retrospectives
The key insight: Plateaued metrics usually mean the programme has run out of things that awareness can fix. The next gains come from diagnosing capability, opportunity and motivation, and that is what the designer is built to do.
What this achieves
A diagnosis, not a hunch Every intervention starts from what is actually stopping the behaviour.
Interventions that are tests Each one states what it expects to change, so you learn whether it did.
A way past the plateau The catalogue of things to try becomes a method for choosing between them.
Ideal for: Awareness leads whose programme is mature on delivery and stuck on outcomes.
04
Your network spans divisions, sites or countries. A handful of well-connected Champions carry most of the reach, whole areas have nobody, and when one of the good ones moves on you lose a region. You need to see the shape of the network, not just the list.
How Heroes supports this · Base and Risk & Incidents are available now; other named modules are in development
1
Base
See coverage by team, site and function
The coverage map shows which parts of the organisation have a Champion and which do not, and the Champion influence map captures how security actually spreads.
2
Network Optimisation
Read the network in detail
Who bridges teams, who is isolated, which areas are unreached, and whose position carries a message furthest.
3
Network Optimisation
Recruit from the gaps
Recruitment targeting drawn from the network rather than from whoever volunteers, so every new Champion adds reach.
4
Network Optimisation
Protect against single points of failure
Succession planning and single-link coverage risk, so the network outlasts any one person.
Capabilities involved
Coverage map
Champion influence map
Network analysis
Centrality and bridges
Recruitment targeting
Succession planning
The key insight: Influence travels through the real network, not the org chart. A network that is designed around where influence actually flows needs fewer Champions to reach more people, and survives the ones who leave.
What this achieves
Coverage you can see Gaps by team, site and function, before they become incidents.
Recruits that count Each new Champion chosen for the reach they add.
A network that outlasts its members Succession and single-link risk managed rather than discovered.
Ideal for: Group programme managers and anyone who has inherited a network larger than they can see.
05
Something happened, and the Champions programme was part of the response. Now the security team needs the programme to record what happens on the ground, see the pattern in it, and work on the behaviours that the incidents point to, without waiting for the network to mature first.
How Heroes supports this · Base and Risk & Incidents are available now; other named modules are in development
1
Base
Point the programme at the behaviours that matter
Priority behaviours chosen because of what happened, with interventions designed and run through Champions in the teams affected.
2
Risk & Incidents
Record risks and incidents in the programme
A risk register and heatmap that Champions and the whole workforce can report into, and an incident register tied to behaviours with a review queue.
3
Risk & Incidents
Let the pattern set the priority
Each incident under review gets a recommended response, priority, campaign or intervention, from the pattern across teams and quarters, so the programme responds to evidence rather than to the most recent headline.
4
Risk & Incidents
Get intelligence to the people who need it
Threat intelligence written by your security team in plain language, with a read-only feed Champions can take to their teams.
Capabilities involved
Priority behaviours
Guided designer
Risk register
Incident register
Behaviour attribution
Threat intelligence
The key insight: A programme that started with an incident should not have to climb a maturity ladder before it can record the next one. Risk & Incidents is available from day one for exactly that reason.
What this achieves
Incidents tied to behaviours Every record points at something the programme can act on.
Priorities set by the pattern The next behaviour to work on comes from the data, not the loudest voice.
Intelligence that reaches people Written for Champions and their teams, not for analysts.
Ideal for: Security teams whose Champions programme is part of how they manage risk.