Starting a security champions program: the first 90 days

A security champions program works when volunteers from engineering teams get protected time, a small clear job and direct access to the security team. Start with a handful of people, a monthly meeting and two or three concrete tasks. Expand only after the first group shows results.

Before you recruit (days 1 to 15)

Decide what a champion does. Keep it narrow:

• Be the first reviewer for security questions in their team.
• Bring team concerns to a monthly meeting.
• Pass back what they learn.

Decide the time: two to four hours a month is a realistic start. Get the engineering manager to agree in writing that this time is protected. Without that, the program dies in the first busy sprint.

Pick the first group (days 15 to 30)

Choose volunteers, not appointees. Aim for one person from each major team, three to eight people total. Look for curiosity and credibility with peers, not seniority. Tell candidates what you will give them: training, access to the security team and recognition in their review.

Kickoff and training (days 30 to 45)

Run a half day session:

1. How the company's risks map to their code and systems.
2. A hands on exercise, such as reviewing a pull request with planted flaws.
3. How to escalate, and to whom.

Give them real work (days 45 to 75)

Pick two or three tasks with visible outcomes:

• Triage the dependency findings for their own service.
• Run a threat modelling session on one feature.
• Review how secrets are stored in one repository.

Let them present results at the monthly meeting.

Measure carefully (days 75 to 90)

Good signals: security questions raised earlier in design, time from finding to fix on champion teams, champion retention. Weak signals: attendance counts alone.

The OWASP Security Culture project has a pointed warning on its survey results: never use them for hiring, promotion, performance review, discipline or access control. Apply the same rule to champion data. If people fear it is used against them, they will stop volunteering.

Common failure modes

• Champions become the team's security janitors with no time budget.
• The security team stops showing up after launch.
• Managers see it as extra work and not as part of the job.
• No recognition, so burnout follows.

At day 90

Review with the champions. Ask what to stop, what to add, and who else should join. Share a one page summary with leadership.

If dependency triage is one of the tasks, Safeguard's SBOM and dependency scanning, including reachability analysis, can give champions a ranked list to work from.

Quick check

Sources

• OWASP Security Culture project

Last reviewed: 19 October 2026.