Security champions vs the security team: who owns what?

Champions own security habits and first answers inside their own team. The security team owns standards, shared tooling, escalation and the program itself. Writing down the split avoids the two common failures: champions drowning in triage, and the security team assuming champions have it covered.

Start from the OWASP principles

The OWASP Security Champions Guide includes principles such as trust your champions, nominate a dedicated captain and secure management support. Together they point to a division of roles: the captain runs the program, management protects the time, and champions get real responsibility.

The guide does not hand out a standard RACI, and it says one size will not fit all. So treat the table below as a starting point to adapt, not as a rule from OWASP.

A starting split

Champions typically own

• Raising security questions during refinement and design.
• Running or co-running threat modeling sessions for their team's features.
• Being the first reader of security tool output for their team and deciding what is noise.
• Sharing practices with teammates.
• Escalating things they cannot decide.

The security team typically owns

• Standards and policies, including exception rules.
• Shared tooling and its configuration.
• Incident response and vulnerability disclosure handling.
• Deep review of high risk designs.
• Training content and the champions program itself.

Shared

• Prioritizing findings: champions know the code, the security team knows the threat picture.
• Paved road components: the security team designs, champions test and give feedback.

Where it goes wrong

• Champions become the single triage point for their team and burn out.
• The security team reroutes every request through champions, including ones that need specialists.
• Nobody owns accepted risks. Make an owner explicit, with a sign off from someone with authority.
• Champions decide alone on things that need a policy exception.

Make it visible

Put the split on one page that every champion and every manager can read. Review it twice a year. When something falls between chairs, add it to the page.

Escalation rules

Agree in advance on what a champion should escalate: anything involving customer data exposure, any suspicion of compromise, any request to disable a control, and anything they are not comfortable deciding. A short, clear list prevents hesitation and prevents overreach.

Quick check

Sources

• OWASP Security Champions Guide

Last reviewed: 19 October 2026.