The OWASP Security Champions Guide lists ten principles for building a champions program: be passionate about security, start with a clear vision, secure management support, nominate a dedicated captain, trust your champions, create a community, promote knowledge sharing, reward responsibility, invest in your champions, and anticipate personnel changes.
What the guide is
It is an open source, vendor neutral guidebook for application security professionals who build champion programs. Its own framing is that one size will not fit all, so you pick the elements that suit you. The pages we fetched show the principle titles, so the notes below are our reading of them, not a quotation of OWASP's text. Read the full guide for the authors' wording.
The ten, grouped
| Group | Principles | What it means for you |
|---|---|---|
| Foundation | Be passionate about security; Start with a clear vision | Know why you want champions and what changes if it works |
| Backing | Secure management support; Nominate a dedicated captain | A sponsor to protect time, and one person to run the program |
| Culture | Trust your champions; Create a community; Promote knowledge sharing | Give real decisions to champions and let them talk to each other |
| Sustaining | Reward responsibility; Invest in your champions; Anticipate personnel changes | Recognition, training and a plan for turnover |
Turning each group into a task
Foundation. Write a half page: the problem you see (repeat findings, slow reviews), the outcome you want, and how you will know. Without a stated vision, the program turns into a mailing list.
Backing. Ask your sponsor for protected time, in writing. Name the captain: see our post on the captain role.
Culture. Set up a channel and a standing meeting. Let champions decide the topic of the next session. Give them a real vote on standards, not only the task of reading them.
Sustaining. Plan recognition in advance, budget for training, and keep a list of who could step in when someone leaves.
Where programs stumble
- No captain, so nobody owns the calendar.
- No manager commitment, so the time evaporates.
- Training given once at kickoff and never again.
- No succession plan, so a program that depended on two people ends when they move on.
Using the principles as a review
Once a year, rate each principle red, amber or green with your champions in the room. Pick two reds to fix. It takes under an hour and gives you something to report to your sponsor.
Where Safeguard fits
Safeguard provides vulnerability scanning and compliance evidence automation, which give a champions program real data to work from. A free scan is available.
Quick check
Do I have to follow all ten principles?
No. The guide says one size will not fit all. Start with the foundation and backing groups, then add the rest as the program grows.
Is the OWASP guide tied to a product?
It describes itself as vendor neutral and open source.
Sources
Last reviewed: 19 October 2026.
