- › Security champions programs are rarely canceled, so they keep appearing on the slide long after the last thing anybody asked of them.
- › The three things that kill one are unreal time, no authority to move anything, and no answer ever coming back.
- › A champion who raises a problem twice and watches it sit will stop raising problems, and that is a sensible response to what they were shown.
- › Volunteer commitment decays on a schedule, so a program with no re-ask is a program with a quiet expiration date.
- › Fewer people, a specific small ask, a slice of time their manager signed, and a visible answer will outperform a large roster every time.
Somewhere in your organization there is a person who was named a security champion about a year ago. They went to the kickoff, they were pleased to be asked, and they have not been asked to do anything since. The title is still in their email signature, and the program is still on a slide that gets shown to the board once a quarter.
I have built these programs and I have watched them go quiet, and the quiet is the part worth paying attention to. Almost nobody ends a security champions program on purpose. There is no meeting where somebody says the champions thing did not work and we are stopping it, which means the program never leaves the deck and never comes back to life either.
Nobody Ever Says It Is Over
A budget line gets cut in a room where people argue about it. A volunteer program just stops being mentioned, and because nothing was formally withdrawn, nothing triggers a review.
This matters more than it sounds like it should. As long as the program exists on paper, the organization believes it has coverage. When somebody asks how security reaches the business units, the answer is that there are champions in each one, and that answer is technically true and practically empty. The gap between the roster and the activity is invisible until an incident walks straight through a team that had a champion on it the whole time.
If you want to know whether yours is alive, do not look at the roster. Look at when a champion last did something that somebody else can name.
Why a Security Champion Goes Quiet
The people who volunteered were not the problem. Every champions program I have seen start began with an enthusiastic group, because the people who put their hand up for an unpaid extra responsibility are self-selected for caring. Something happened to that enthusiasm, and it happened in a pattern.
The time was never real
The ask is almost always framed as a few hours a month on top of the day job. The day job has a number attached to it that their manager reviews, and the champion work has a calendar invite that gets moved when something real comes up.
Nobody is choosing security over their performance review. They are responding accurately to the only signal the organization gave them about what counts. When a program is funded with goodwill alone, goodwill is what runs out first.
They could raise something and not move it
This is the one that does the most damage. A champion notices that their team routes around a control, or that the shared account everybody uses has not had its password changed since the last person left, and they report it the way they were asked to.
Then nothing happens. Perhaps it goes into a backlog, perhaps it gets an acknowledgment and no owner, and either way the champion has now learned what raising something is worth. By the second time they raise something and watch it sit, they have drawn a reasonable conclusion from two clean data points, and the conclusion is that this channel does not move anything. Disengaging at that stage is the sensible read of the evidence in front of them.
Nothing ever came back
Even when the report did lead to a fix, the champion is usually the last to find out, if they find out at all. The work happened inside the security team, closed inside the security team’s ticketing system, and the person who surfaced it got no signal that their five minutes changed anything.
From studying why people stay in demanding workplaces, the thing that keeps someone engaged in discretionary work is almost never recognition in the ceremonial sense. It is evidence that the effort connected to an outcome. Remove that evidence and the effort becomes indistinguishable from a favor nobody acknowledged.
Why This Looks Like a People Problem
When the program goes quiet, the story the organization tells itself is about the champions. They lost interest, they got busy, you know how it is with volunteers. That read is comfortable because it requires nothing of anyone.
It is also wrong in a way that guarantees the next attempt fails the same way. The behavior you observed was produced by the structure you built, which gave them no protected time and no way to move anything they found. Recruit thirty new people into that same structure and you will get the same curve, a little faster, because some of them watched the last cohort.
This is the same mechanism behind why punishing people for reporting incidents makes reporting stop. The organization designs a consequence, people respond to the consequence, and then the organization treats the response as a character flaw. Marking the person rather than the design keeps everyone busy and fixes nothing.
What the Ones That Work Do Differently
I want to be careful here, because the advice that usually follows this diagnosis is to relaunch with more enthusiasm, and enthusiasm was never the scarce input. The programs I have seen survive past two years share a few structural choices, and none of them require budget.
Pick fewer people and ask for something specific. A roster of forty names with a vague mandate to promote security produces nothing measurable. Six people with one concrete responsibility each, something like reviewing the access list for their own team every quarter, will produce work you can point at. A small ask that gets done beats a large one that gets deferred.
Make the time real by getting the manager to sign it. The champion’s manager has to agree in a way that survives a busy month, which means the commitment belongs in whatever system the organization uses to allocate people. If the manager will not agree to it, you have learned something useful before you spent a year finding out slowly.
Close the loop out loud. When a champion raises something, tell them what happened to it, including when the answer is that you looked and decided not to act. A visible no is better than silence, because a person who gets an answer learns the channel is real, and a person who gets nothing has no reason to think so. This is the cheapest intervention on the list and the one most often skipped.
Put an end date on it and re-ask. Name the commitment as a twelve month term and go back at the end to ask whether they want to continue. Volunteer energy has a half-life whether or not you acknowledge it, and a program with a re-ask built in gets an honest answer instead of a roster full of people who quietly stopped a year ago. It also gives you a real number for how many people are in.
The Measurement Nobody Wants
The reason these programs survive on slides is that the metric is headcount, and headcount only goes up. Somebody counts the names, reports growth, and the number looks like health right up until you need the program to do something.
Count activity instead. How many champions did something in the last quarter that a person outside the security team could describe, and how many things did they raise, and how many of those got an answer. Those numbers will be worse than the roster number and they will be true, which is the entire point of measuring culture rather than attendance.
A champions program is one part of the wider work of defending the human layer, and it is the part that most directly tests whether the organization means it. Awareness training can be bought and deployed to everybody at once. A champions program requires the organization to give a small number of people real time and real answers, on an ongoing basis, for something that will never show up in a quarterly result.
Most organizations find out they were unwilling to do that about fourteen months in, and by then nobody remembers deciding. The decision got made in a hundred small moments where a champion’s question went unanswered and a champion’s hour got taken back, none of which felt like a decision at the time.
So go and look at yours. Find the roster, pick three names off it, and ask each of them what they were asked to do this year and what came of it. You will know within an afternoon whether you are running a program or maintaining a list, and the people you ask will tell you the truth, because nobody has asked them anything in a while.
Marie Welch is Director of Behavioral Security Operations at Grab The Axe.
With a dual background in I/O Psychology (PhD Candidate) and Business Management (MBA), Marie bridges the gap between clinical rigor and operational strategy. She oversees B2B relations, compliance, and the 'business' of risk management.
View Author Page →
