A weekly security hour works when it has a fixed agenda and one owner. Spend it on new access and leavers, open alerts, updates, reported phishing, and one small improvement. Add a monthly and quarterly layer for slower jobs. The point is to make security routine instead of a reaction to scares.
The weekly agenda
Keep the same order each week so it takes little thought.
- Joiners and leavers, 10 minutes. Check that accounts were created with MFA and that leaver access was removed.
- Alerts, 15 minutes. Dependency alerts, secret scanning alerts, cloud console warnings. Assign or dismiss with a reason.
- Updates, 10 minutes. Operating systems, browsers, critical packages and base images.
- Reports, 10 minutes. Phishing reports, support tickets with security questions, anything odd in logs.
- One improvement, 15 minutes. Pick one item from a standing list and finish or advance it.
Monthly additions
Review admin accounts and shared vault entries. Check that backups ran. Look at the vendor and tool list for new additions. Look at who has production access.
Quarterly additions
Run a restore test from backup. Review access to source control, cloud and the identity provider more carefully. Run a short tabletop on one scenario. Update the incident contact list. Confirm device encryption on all laptops.
Pick an owner and rotate
A named owner makes it happen. Rotate the owner each quarter so knowledge spreads and nobody burns out. Write notes in a single shared page so that whoever owns it next can see what was done.
Keep a standing improvement list
Examples: move a service to single sign on, replace a long lived key with a role, add branch protection to a repository, write a one page incident plan. Each one is small. Over a year they add up to a program.
Record, lightly
A short log of date, what was checked and what changed is good evidence for customers and auditors. It also shows the work, which helps when you need to ask for budget.
What not to do.
Do not turn it into a status meeting. Do not skip it when busy, since that is when problems pile up. If you must, shorten it.
Common pitfalls.
Tips for keeping it going. Put the hour on the calendar with a recurring invite and a shared page. Keep a running list of questions for the next meeting. When nothing is wrong, celebrate briefly and use the time for the improvement list. If a week is skipped, do not hold two hours the next time. Resume with the usual hour, and note in the log why the gap happened, because patterns in skipped weeks usually reveal that the agenda is too long.
Share a two line summary in the team channel after each session, so that security work stays visible and others can raise issues.
Quick check
Is one hour a week realistic for a ten person company?
Usually yes for basics. As the team and customer demands grow, you will need more time or a dedicated person.
Last reviewed: 19 October 2026.
