Long before I joined Forrester, or even before I worked in cybersecurity, I volunteered with an informal group supporting my previous company’s security team. That experience stayed with me. It sparked my interest in cybersecurity and ultimately led me into the profession. Fast-forward to 2026, and I was thrilled to be asked to update our 2020 research, Build A Security Champions Network.

The original report, as well as the research and interviews of this latest update, were completed by other team members. My job was to put the outcomes of the updated research and interviews together. Coming in at that late stage gave me a unique perspective: I stepped into the research with fresh eyes, listened to my colleagues’ interviews with experts in the field, and challenged my own assumptions. I found myself reflecting on how today’s most successful security champions networks transform security from a central function into a distributed, culturally embedded mechanism for human risk management (HRM). I couldn’t help but compare this with that small, informal network that first introduced me to cybersecurity. This blog explores four themes that both validated my own experience and challenged what I thought I knew about security champions networks:

    1. The mission behind the network matters more than the network itself. A program that centers on “raising security awareness” won’t serve to inspire its champions nor its stakeholders, who need clarity on why the program exists and the impact it aims to have. Before you kick off your program, as well as regularly throughout its lifecycle, sit down with your champions and write a purpose statement together. Ask them what makes the network important to them and the business and what the security team can’t do without them, then keep revisiting and updating that statement as the program evolves.
    2. Meaningful contributions motivate champions more than tangible rewards. Not all benefits have to be monetary — many champions just want to make a meaningful contribution. Eighty-three percent of effective programs rely on self-motivated volunteers, which means material rewards — such as points-based currency or merchandise alone — won’t motivate everyone. Consider nonmaterial rewards like increasing the champions’ visibility by spotlighting them, contributing to their professional growth with structured learning pathways, or providing access to leadership. Test rewards with your champions to find out which ones work best before you set a points-and-prizes budget.
    3. A growing champions count masks real outcomes. Growing a champions network is hard because your champions are short on time, you may not have the buy-in or sponsorship that you need, and cultural fit is a constant work in progress. Only 7% of organizations use dedicated tools to measure whether the program reduces real risk or changes behavior. On the other hand, reporting on your network’s size is easy, which is why many programs default to easy-to-measure metrics like program attendance and engagement. You must overcome this challenge, because you need to measure the impact of not only your champions network but your HRM program. Extend tactical engagement to metrics that align to your goals, which may include improvement in cybersafe behavior, reduced security friction, and lower cost from human-related breaches.
    4. Unclear role expectations overload champions and weaken program momentum. Programs often fail when you underestimate the operational burden of running the program, both to yourself and the champions. Vague, expanding responsibilities without clear boundaries lead to champions losing engagement, experiencing friction in their day-to-day work, and struggling to balance their champion role with their primary responsibilities. To avoid that, start with a narrow scope, set a simple operational cadence, agree on time commitment, and accept early on that you can’t track every single activity or outcome. Review the program and the champions’ workload annually or biannually, ask champions directly if the role still works, and let disengaged champions step aside gracefully.

Let’s Connect

Is your security champions network a deliberate design choice or a collection of good intentions that requires constant restructuring? If it’s the latter, read the full report on Forrester.com and schedule an inquiry or guidance session with me to work through what this means for your organization.

Share