Building Security Champions: Clarifying Mandate, Interfaces, and Boundaries

Security Champions are meant to bring security knowledge closer to business departments and teams. In practice, however, a shadow role quickly emerges: an engaged individual answers questions, shares tips, and gets called upon when problems arise—without having a clear mandate, a reliable escalation path, or backing from management. This increases the reach of security communication, but does not yet solve an organizational problem.

For CISOs, therefore, the primary metric is not the number of designated champions. What is crucial is whether the network functions as a resilient interface. Champions need to know which questions they can evaluate themselves, when to escalate, and who on the central security team makes decisions. Just as important is the reverse channel: the security team needs insight into local workflows, unclear policies, and recurring obstacles.

Why Champions Without a Mandate Become a Shadow Role

The BSI defines clear organizational prerequisites for awareness and training programs. These include management support, unambiguous goals, continuity, and adequate resources. In module ORP.3, fundamental responsibility remains with the Information Security Officer; other roles such as IT operations, managers, and the HR department contribute. This separation is also central to a champion network: participation distributes access across the organization, but not automatically formal responsibility.

Without this clarity, conflicting expectations arise. Teams might view champions as a local sign-off authority. The central security team, on the other hand, primarily expects communication. Managers see the role as a voluntary extra task. Such a model relies on personal commitment and loses reliability as soon as operational work takes priority.

The Interface Is the Real Task

A qualitative study by Jonas Hielscher and Simon Parkin investigated what shapes security awareness in organizations with 15 full-time practitioners from European companies. The researchers describe a tension between communicating secure behavior and establishing a connection with employees. In the interviews, Security Champions emerged as a way to reduce the distance between the central security function and teams, to pass on information, and to capture feedback.

The small qualitative sample is not general proof of effectiveness. However, it provides robust guidance for implementation: champions are particularly useful where context needs to flow in both directions. They can explain why a policy is difficult to implement in the workflow, consolidate local questions, and make visible where rules, processes, or tools need improvement.

The UK NCSC takes the same systemic view. Good security decisions do not depend solely on knowledge, but also on time, effort, social norms, and available support. Repeated training therefore does not solve a problem whose root cause lies in an impractical process. A champion network should make such friction visible early, rather than papering over it with additional communication.

Four Points for a Resilient Mandate

Before launching, the mandate should answer four questions in writing:

1. Mission: Which security objectives does the network support, and which target groups or business units is it responsible for?

2. Authority: What information are champions authorized to pass on authoritatively, and on which questions do they require a decision from the security team?

3. Escalation: Through which channel do suspected incidents, policy conflicts, and urgent questions reach the responsible entity?

4. Feedback: How do champions learn what came of their input, and how do recurring issues feed back into policies, controls, or awareness topics?

These four points protect both sides. Champions do not have to advocate for decisions for which they lack authority or technical expertise. At the same time, the central team receives structured input from the organization and can identify whether an isolated incident points to a broader process problem.

Where Responsibility Deliberately Ends

Security Champions replace neither the Information Security Officer nor Incident Response, Data Protection, Compliance, or technical specialists. They should not evaluate incidents on their own, approve exceptions, or invent local rules. Even initial technical guidance must not supplant the official reporting and escalation channels.

This boundary is not a weakening of the role. It makes it dependable. A champion can be the familiar contact person in the team and still refer to the designated process. For the CISO, it remains transparent who makes decisions and where evidence is generated. This prevents parallel shadow processes where relevant information remains confined to personal chats or informal conversations.

Feedback Channel Instead of One-Way Communication

Many programs initially view champions as multipliers: the central team provides messaging that is distributed locally. This leaves a significant part of their value untapped. Local feedback reveals whether policies are understandable, whether a reporting channel is accessible, and where secure processes collide with actual working conditions.

The NCSC recommends ongoing feedback and testing for security-critical tools and processes. This underlying concept translates directly to the network: feedback requires a designated intake point, transparent handling, and a response. If feedback leads to no visible outcome, the incentive to report problems early diminishes. If, on the other hand, insights are consolidated and passed on to process owners, the network can help improve both security and usability.

How CISOs Steer the Network

Management should combine multiple signals. The number of active champions demonstrates reach, but not the utility of the network. More revealing are questions such as: Are relevant concerns escalated through the designated pathway? Does the central team provide an assessment within an agreed timeframe? Which topics recur across multiple departments? And does feedback lead to clearer policies, improved reporting pathways, or the review of technical controls?

The limitations of such metrics should be acknowledged. An increase in inquiries can indicate uncertainty, but also growing trust in the reporting process. A declining number of escalations can reflect clearer processes or a dormant network. Anyone looking to measure security awareness should therefore consider reach, activity, process quality, and organizational outcomes separately.

Regularly reviewing the mandate is also part of governing the network. If business processes, points of contact, or risks change, tasks and escalation pathways must be adapted. The BSI requires that target-group-oriented programs be reviewed regularly and that findings be incorporated into their improvement. A champion network is therefore not a one-off organizational chart exercise, but an actively maintained component of the awareness program.

What The Hack! as a Shared Learning Opportunity

A champion network needs common topics and discussion prompts without automatically creating new responsibilities. The Security Awareness Platform by What The Hack! supports authorized team and solo use with selectable themed campaigns. Following sessions, game results, analytics, and certificates of completion are available. Champions can use these outcomes as indicators of topics requiring further explanation in their own area; decisions regarding risks, exceptions, or controls remain with the responsible security team.

Whether a self-managed platform, a facilitated session, or a combination of both is the best fit is a separate operational decision. The article Security Awareness Event or Platform evaluates this based on objective, cadence, internal effort, and analysis. A champion network can support both formats, but replaces neither program planning nor domain responsibility.

Conclusion: Reach Requires Ownership

Security Champions can bridge the gap between the central security function and day-to-day work. To do so, they need more than just a title. A resilient model establishes mission, authority, escalation, and feedback. It safeguards formal responsibility, exposes local friction, and creates a dependable channel for questions from teams.

For CISOs, the decisive test is therefore: Has a network been established that moves information in both directions and connects to clear processes? Only then do committed individuals turn into a viable organizational interface.

Sources

• BSI: IT-Grundschutz Module ORP.3 – Information Security Awareness and Training

• Hielscher/Parkin: What Keeps People Secure is That They Met The Security Team (USENIX Security 2024)

• UK NCSC: Putting people at the heart of an organisation’s approach to cyber security