A Security Champion is a member of the workforce, not the security team, who takes on a voluntary role helping the people around them work securely. They do it through trust and example, not enforcement. Champions are chosen for their influence with colleagues, not their technical knowledge, and the role takes twenty to thirty minutes a week.
Your most important security investment is already in the building.
A Champion is the bridge between security professionals and the people doing the work. They do not enforce policy. They translate it into terms that make sense for their team, model good habits, and become the person colleagues turn to when something feels off.
That informal credibility is what makes them effective in ways a formal security function rarely can be. People change what they do because of the people around them, and a Champion is one of those people.
The role should never become a second job. Twenty to thirty minutes a week, agreed with the Champion's manager, is enough when the tasks are focused and the support is there.
Champions put security requirements into the language and reality of their team, so they feel relevant rather than imposed.
By being open about near-misses and mistakes, Champions build the psychological safety that makes reporting the default.
Because Champions sit inside the team, they hear things the security function never would. They are an early warning system built on trust.
Through small, regular prompts and conversations, Champions help colleagues form secure habits that outlast any training event.
Champions feed back what their teams think, feel and struggle with, which is what the security team needs to design better interventions.
Information passes on a single contact. Behaviour does not. Reporting a suspicious email or challenging a senior request costs effort and carries social risk, so most people wait until they have seen a few colleagues do it first.
A Champion is one of those colleagues, in the room, every week. That is something a training course cannot be.
The evidence is in Simple and Complex Contagion, and what it means for how many Champions a team needs is in The Champion Density Problem.
The person colleagues already go to with questions. Volunteers bring motivation and managers' nominees bring availability, but neither guarantees influence.
Look for trust within the team, the confidence to speak up, a manager who will protect the time, and curiosity about security. Technical depth is optional.
For how to find and ask those people, read Volunteer, voluntold or chosen.
Security spending has usually put technology first, with process and people following, and the human element is still the dominant factor in most incidents. We put people first, because people are the context in which technology and process either work or fail.
The foundation. People bring judgement, social norms and the capacity to change. Equipped and supported, they make technology work as intended and flag when it does not. Champions are how that happens, team by team.
Processes give good intentions a reliable channel, and they work when people understand why they exist. Champions help design processes that are usable, not just auditable, and report back where they get in the way.
Technology is the amplifier. Deployed by people who understand it, within processes that support it, it adds real capability. Without that foundation it adds complexity and cost. Champions make the investment go further.
A security team cannot be in every meeting or every decision. With a Champion in engineering, finance, HR and operations, security thinking is present while the work is being done.
Security ownership is spread across the organisation, not concentrated in one function.
The security team hears what is happening on the ground, not what policy says should happen.
Culture is built through repeated interactions and shared norms. Champions create those in each team.
Champions turn a new threat into action that makes sense locally, faster than a central team can.
People feel safe reporting mistakes and near-misses, which is the early warning every security team needs.
Beyond the organisation. Habits travel. The secure behaviours people pick up at work go home with them, to family, to community groups, to suppliers and to their next employer. Every Champion you develop raises the security of the people around them as well as your own.
One Champion changes a team. Connect them, give them a shared rhythm and measure what happens around them, and you have a Champions Network: a capability the organisation keeps when individuals move on.
Heroes is not a generic LMS or HR platform repurposed for security. It is built for the specific job of running a Security Champions programme, on the COM-B model and Behaviour Change Wheel, to help you find the right people, develop them, and measure the change they create.
A member of the workforce, outside the security team, who takes on a voluntary role helping the people around them work securely, through trust and example.
No. Champions stay in their own roles and teams. That is the point: they are present where the work happens, and colleagues listen to them as peers.
Twenty to thirty minutes a week is enough for a well-run programme. Agree the time with each Champion's manager before they start.
Start with a small first cohort and grow from what you learn. The right number for each team depends on its size and how connected it is. The Champion Density Problem covers the evidence.
For influence first. Ask who colleagues go to for advice, then ask those people personally and give them a real choice. Volunteer, voluntold or chosen sets out the approach.
A Champion is a role held by one person. A Champions Network is those people connected, coordinated and measured as one programme.
No. Trust and communication matter more. Champions are chosen for their standing with colleagues, and the security team supplies the technical knowledge.
Start your free trial of Heroes - no credit card required.