# How to start a Security Champions Program?

**URL:** <https://threatmodelingconnect.discourse.group/t/how-to-start-a-security-champions-program/38>\
**Category:** General\
**Tags:** management\
**Created:** [December 4, 2022, 8:00am UTC](https://threatmodelingconnect.discourse.group/t/how-to-start-a-security-champions-program/38 "2022-12-04T08:00:00Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![community\_migration](https://sea2.discourse-cdn.com/flex002/user_avatar/threatmodelingconnect.discourse.group/community_migration/32/366_2.png) [@community\_migration](https://threatmodelingconnect.discourse.group/u/community_migration)\
**Post date:** [December 4, 2022, 8:00am UTC](https://threatmodelingconnect.discourse.group/t/how-to-start-a-security-champions-program/38/1 "2022-12-04T08:00:00Z")

</div>

Original posted by @kchau

Hi folks!

I hear the term security champions being thrown around quite often and how important it is for some to start building the program. I’ve seen different companies approach the topic very differently with some succeeding and some outright failures. Some have started with initiatives to train their entire development organization to understand security a little better before heading down this path. Some have asked for volunteers and incentivize them to help be part of the team and help build the process. Others may go ahead and just select individuals themselves and “volunteer” them to be the bridge for the teams.

My question for you all is, what has your experience been like? Is there a method that works better than others? What are some great ways to start this discussion with various teams and how do we get them more engaged? Where should a company start when thinking of building a Security Champions program? Are the any specifics that need to be considered before starting these conversations?

---

<div class="post-metadata">

**Author:** ![AppSecSeanner](https://avatars.discourse-cdn.com/v4/letter/a/5e9695/32.png) [@AppSecSeanner](https://threatmodelingconnect.discourse.group/u/AppSecSeanner)\
**Post date:** [October 4, 2024, 8:45pm UTC](https://threatmodelingconnect.discourse.group/t/how-to-start-a-security-champions-program/38/2 "2024-10-04T20:45:59Z")

</div>

At OWASP AppSec Lisbon there were three really great talks about this I want to share:

**Growing A Security Champion Program Into A Security Powerhouse - Bonnie Viteri**  
[YouTube](https://www.youtube.com/watch?v=Y0mJuAdi9DY&list=PLpr-xdpM8wG_yb_Xv2nD0fbCTE_UE-6Ae&index=52)

**Security Champions And Experiments: Building Blocks For Cultural Change - Mads Andersen**  
[YouTube](https://www.youtube.com/watch?v=8JlMXx1WJOM&list=PLpr-xdpM8wG_yb_Xv2nD0fbCTE_UE-6Ae&index=14)

**Leveraging Psychological Needs For Building A Security Culture Amongst Developers - Juliane Reimann**  
[YouTube](https://www.youtube.com/watch?v=3m1ASrjfkbk&list=PLpr-xdpM8wG_yb_Xv2nD0fbCTE_UE-6Ae&index=5)

**My very high level take aways**

- You will need buy in from the organization leadership
- You will need some kind of a budget (time + money)
- Leverage human traits to want to be part of a culture and be rewarded, this helps keep people happy while sacrificing their time.
- Celebrate success stories and wins all the way up to the executive team, but also all the way across the organization.
- Don’t give champions the shit work the security team does not want.

---

<div class="post-metadata">

**Author:** ![dragon44](https://sea2.discourse-cdn.com/flex002/user_avatar/threatmodelingconnect.discourse.group/dragon44/32/14_2.png) [@dragon44](https://threatmodelingconnect.discourse.group/u/dragon44)\
**Post date:** [December 3, 2024, 1:56pm UTC](https://threatmodelingconnect.discourse.group/t/how-to-start-a-security-champions-program/38/3 "2024-12-03T13:56:53Z")

</div>

Another good resource from OWASP which might be interesting to look at. They are soon going to publish some real life artefacts from organisations who have done it on the grounds.

> **[OWASP Security Champions Guide | OWASP Foundation](https://owasp.org/www-project-security-champions-guidebook/)**
>
> Our goal is to create an open-source, vendor-neutral guidebook for AppSec professionals to help them build and improve their own successful Security Champion programs.