There is no standard ratio of champions to developers in the sources we checked. OWASP SAMM level 1 asks for a security champion in each development team, so size by team, then add a backup for high risk teams. Count teams, not headcount.
The rule that is written down
SAMM Stream B, level 1, describes a liaison in each development team between information security and developers. That makes the unit of coverage the team. Be wary of any article that quotes a fixed percentage of staff, such as "one in ten", without a source. We did not find one in the OWASP material we reviewed.
Size by risk
Not every team needs the same coverage. A rough scheme you can adapt:
| Team type | Suggested coverage | Why |
|---|---|---|
| Internet facing, handles personal or payment data | Champion plus a named backup | High impact, needs continuity |
| Internal tools with sensitive access | One champion | Moderate exposure |
| Low risk or short lived projects | Shared champion across two teams, or the security group covers them | Avoid spreading thin |
| Platform and infrastructure | One champion with ops knowledge | Controls pipelines others rely on |
| Data and ML | One champion who knows the data flows | Often missed in plans |
The table is a starting point from our own reasoning, not a published standard.
A sizing method
- List your teams that own code or infrastructure.
- Mark each as high, medium or low risk.
- Assign one champion per high and medium team, plus a backup for high.
- Group low risk teams in pairs.
- Add a captain to run the program.
- Check the load: can each champion really protect a few hours a week?
Start smaller than you think
Launch with the three or four teams that matter most. A small group that works makes the case for the next wave. A big launch with half the champions inactive does damage.
Watch the workload
If a champion covers two teams, expect response times to slip. If one person is champion for five teams, that is a bottleneck, not a program. When you plan headcount, remember the time: ten champions at three hours a week is thirty hours of capacity you are borrowing from product work. Say so to your sponsor.
When to add more
Add champions when a team's repeat findings stay high, when a team grows past what one person can cover, or when you start a new product line. Review coverage yearly.
Where Safeguard fits
Safeguard provides asset discovery, which helps you list the teams and services that need coverage before you size a program.
Quick check
Is one champion per team enough for a team of 30?
Often not. Consider two, or a champion per squad inside the team, so reviews and questions are not queued behind one person.
Do very small companies need a program?
Under about a handful of developers, a named person and a monthly conversation may be enough. Formal structure can wait.
Sources
Last reviewed: 19 October 2026.
