Champions stay engaged when the work is visible, trusted and rewarded. Five of the ten OWASP Security Champions principles speak directly to this: trust your champions, create a community, promote knowledge sharing, reward responsibility and invest in your champions. Most drop-off is a failure of those five, not of the people.
Trust them with real decisions
If a champion can only forward findings to the security team, they are a mailbox. Give them authority over something concrete. Examples: approving low risk exceptions to a dependency policy for their team, running the team's design review, or choosing which static analysis rule to tune first.
Trust also means accepting that champions will sometimes decide differently than the security team would have. Write down the boundaries, then respect them.
Build a community, not a mailing list
Champions often sit alone in a team of ten developers. The group is where they find peers. A chat channel for quick questions and a regular call for deeper topics are enough. Let champions present to each other. Teaching a topic is the fastest way to learn it, and it spreads good habits across teams without the security team doing the talking.
Make the reward match the work
Reward does not have to be money. Useful options include:
- Naming the work in performance reviews, with the manager's agreement in advance.
- Learning budget for conferences or courses the champion chooses.
- A visible mention when a champion's review prevented a problem.
- Time protected on the team plan, which is a reward in itself.
The OWASP guide treats rewarding responsibility as a principle, so do not leave it for later.
Invest where they work
Generic awareness courses bore people who already care. Offer training tied to the champion's stack: secure handling of sessions in their web framework, threat modeling for their service, or dependency review for their ecosystem. Pair a new champion with an experienced one for their first design review.
Plan for the people who leave
Turnover is normal. The guide lists anticipating personnel changes. Keep a short onboarding page, a recorded walk through of the program and a list of past work so a new champion can start in an afternoon.
Signals that engagement is slipping
- Attendance drops for two meetings in a row.
- Champions stop raising issues in the shared channel.
- Managers stop mentioning the program in planning.
When you see these, ask champions directly what is getting in the way. The answer is usually time or lack of recognition, and both are fixable.
A simple annual cycle
Run the program in a yearly rhythm. In the first quarter, agree goals with champions, not for them. In the second and third, rotate who hosts the meeting and share one story each of a problem caught early. In the last quarter, hold a review: what worked, who needs a break, who wants to take on more. Offer people a graceful exit. Someone who steps back cleanly can return later, while someone who quietly disappears usually does not.
Quick check
Is a leaderboard a good way to reward champions?
Usually not. Ranking individuals by findings closed pushes people toward easy fixes. Recognize outcomes and effort instead.
Sources
Last reviewed: 19 October 2026.
