Central teams give consistency, embedded engineers give context, and federated models spread ownership through champions. Small companies do best with one owner plus champions. Larger ones usually settle on a hybrid: a central team sets standards and tooling, while people inside each unit handle daily triage.
The three models
| Model | How it works | Strength | Weakness |
|---|---|---|---|
| Central | One security team serves all engineering | Consistent standards | Becomes a queue |
| Embedded | Security engineers sit inside product teams | Deep context | Expensive, uneven practice |
| Federated | Developers act as champions with a central core | Scales, cheap | Depends on time and training |
Roles you may need
- Program owner: sets goals, reports, decides priority.
- AppSec engineer: triage, tuning, reviews, guidance.
- Security champion: first contact inside a team, part time.
- Product security or security architect: design review and threat modeling for high risk systems.
- Tooling or platform engineer: keeps scanners and gates running.
Small teams combine these in one or two people. Do not hire eight titles before you have the work.
How to choose
- Look at risk, not headcount. A small company handling sensitive data needs more than its size suggests.
- Look at culture. Strong autonomy teams resist central queues. Regulated, process oriented ones may prefer them.
- Look at how often you ship. Frequent releases need automation and trained developers, since reviewers cannot keep up.
- Look at the talent available. Embedded models need experienced people who are scarce.
Making federated work
Champions need protected time, training and a link to the central team. Without these, the model decays within months. See keeping champions engaged.
Try it yourself
Click through it at your own pace, or open it full screen.
Look at how monitoring runs without a person watching. Whichever team model you choose, automation like this is what lets a small team cover a large estate.
Quick check
Is the embedded model better than central?
Not always. It gives better context but costs more and can produce inconsistent practice across teams. Most organizations blend models.
How many champions do we need?
At least one per team that ships code, with a backup. Start with volunteers.
Safeguard provides policies, gates and guardrails and continuous monitoring so central standards can be enforced without a central queue. Try the free scan.
Last reviewed: 19 October 2026.
