A champions program puts a named person in each team. A guild is a voluntary community of interest across teams. A center of excellence is a chartered group of senior engineers that sets standards. They overlap, and most growing programs use more than one in sequence.
Definitions
Champions program: each development team has a named liaison with the security group. OWASP SAMM Education and Guidance Stream B level 1 describes this.
Center of excellence: SAMM's level 2 activity, the Secure Software Center of Excellence, is a chartered group of architects and senior developers from across business units and technology stacks. It defines security standards, supports product champions who help teams adopt tooling, evaluates tools and reviews significant architectural changes.
Guild or community: SAMM level 3 describes a shared communication and knowledge sharing platform, organized around technologies and roles, that recognizes active contributors and can surface future champions. "Guild" is common industry language for this idea; SAMM does not use that word on the pages we read.
The comparison
| Champions program | Center of excellence | Guild or community | |
|---|---|---|---|
| Membership | One or more per team, assigned or volunteer | Chartered, senior | Open to anyone |
| Main job | Local triage, review, teaching | Standards, tool choice, architecture review | Sharing, learning, recruiting |
| Time commitment | Protected weekly time | Defined charter time | Optional |
| Risk | Overloaded individuals | Becomes a gatekeeper | Fades without a host |
| Start when | You have several teams and repeat findings | You need consistent standards | Interest exists beyond champions |
Which first?
Most organizations should start with champions, because it delivers coverage and a feedback loop quickly. Add a center of excellence when different teams solve the same problem differently and you need consistent standards. Add a community when people outside the formal roles want to join in.
How they fit together
- Champions raise issues and bring team context.
- The center of excellence turns patterns into standards and tooling choices.
- The community spreads the result and finds the next champions.
If you have all three, make sure the charter for each says what it decides and what it only recommends. Our post on who owns what between champions and the security team helps with the split.
Warning signs
- A center of excellence that reviews everything. It will become a queue.
- A community with no moderator. It dies in a quarter.
- Champions with no standards to point to. They will invent their own.
Where Safeguard fits
Safeguard provides policies, gates and guardrails, which help a center of excellence turn standards into automatic checks. A free scan is available.
Quick check
Do we need all three?
No. Many companies run only champions for years. Add the others when you can name the problem they solve.
Who runs a center of excellence?
SAMM describes a chartered group, so give it a named chair, a charter and a review rhythm.
Sources
Last reviewed: 19 October 2026.
