Long before I joined Forrester, or even before I worked in cybersecurity, I volunteered with an informal group supporting my previous company’s security team. That experience stayed with me. It sparked my interest in cybersecurity and ultimately led me into the profession. Fast forward to 2026, I was thrilled to be asked to update our 2019 research, Build A Security Champions Network (Forrester clients access here).

The original report, as well as the research and interviews of this latest update, were completed by other team members. My job was to put the outcomes of the updated research and interviews together. Coming in at that late stage gave me a unique perspective: I stepped into the research with fresh eyes, listened to my colleagues’ interviews with experts in the field and challenged my own assumptions. I found myself reflecting how today’s most successful security champions networks transform security from a central function into a distributed, culturally embedded mechanism for human risk management. I couldn’t help but compare with that small, informal network that first introduced me to cybersecurity. This blog explores four themes that both validated my own experience and challenged what I thought I knew about security champions networks:

  1. The mission behind the network matters more than the network itself. A program that centers on “raise security awareness” will not serve to inspire its champions, nor its stakeholders, who need clarity on why the program exists, as well as the impact it aims to have. Before you kick off your program, and regularly throughout its lifecycle, sit down with your champions and write a purpose statement together. Ask them what makes the network important to them and to the busienss, and what the security team can’t do without them. Then keep revisiting and updating that statement as the program evolves;m
  2. Meaningful contribution motivates champions more than tangible rewards. Not all benefits have to be monetary, many champions just want to make a meaningful contribution. Eighty three percen of effective programs rely on self-motivated volunteers, whcih means material rewards such as points-based currency or merchandise alone will not motivate everyone. Consider non-material rewards such as increasing the champions’ visibility by spotlighting them, contribute to their professional growth with structured learning pathways, or access to leadership. Test rewards with your champions to find out which ones work best before you set a points-and-prizes budget.
  3. A growing champion count masks real outcomes.  Growing a champions network is hard because your champions are short on time, you may not have the buy-in or sponsorship that you need yet, and cultural fit is a constant work in progress. Only 7% of organizations use dedicated tools to measure whether the program reduces real risk or changes behavior.  On the other hand, reporting on your network’s size is easy, which is why many programs default to easy-to-measure metrics like program attendance and engagement. Overcome this challenge, because ultimately you need to measure the impact of not only your champions network, but your HRM program.  Extend  tactical engagement metrics to that align to your goals which may include  improvement in cybersafe behavior, reduced security friction and lower cost from human-related breaches.
  4. Unclear role expectations overload champions and weaken program momentum. Programs often fail when you underestimate the operational burden of running the program, to yourself, and to the champions. Vague, expanding responsibilities without clear boundaries, lead to champions losing engagement, experiencing friction in their day-to-day work, and struggling to balance their champion role with their primary responsibilities. To avoid that, start with a narrow scope, set a simple operational cadence, agree on time commitment and accept early on that you cannot track every single activity or outcome. Review the program and the champions’ workload annually or biannually, ask champions directly if the role still works and let disengaged champions step aside gracefully.

    Let’s Connect
    Is your security champions network a deliberate design choice, or a collection of good intentions that has got to be ever structured? If it’s the latter, read the full report on Forrester.com and schedule an inquiry or guidance session with me to work through what this means for your organization. 

     

 

 

 

 

 

 

Share