c3.9 Run a Security Champions program
Embed a Security Champion in each development team as the focal point with the security team, trained in secure development. Executive sponsorship is the key success factor; without it, teams will not consistently invest their time.
Implementation guidance
Build security capability inside dev teams
Name a Security Champion on each development team to be the day-to-day link with the security team and the guardian of good practices for their team. Executive sponsorship (CIO/CISO) is essential — without it, teams will not commit time to the program.
What makes a good champion
- A security enthusiast who enjoys teaching their teammates.
- Trustworthy: reports issues honestly and provides the information needed to decide (accept the risk, block the deploy, or mitigate).
- Embedded in the team day to day, giving the security team an insider view.
What a champion does
- Learns security and writes test cases to catch critical risks.
- Helps build threat models, knowing the application inside out.
- Acts as the vulnerability manager for their team's code.
Keep it rewarding
Because this is extra work, recognize it: awards for training and for meeting code-security goals, office hours, exclusive training, and gamification (for example, the team that fixes the most flaws, or ships the fewest defects). AWS also runs Security Game Days you can join. For inspiration, see how AWS built its Security Guardians program.
How to validate
- Is there a Security Champion on each development team?
- Does the program have executive sponsorship and dedicated time?
- Are champions trained and recognized, and do they help with threat modeling and vulnerability management for their team?
Threats addressed
- Without embedded security ownership, secure practices depend on a central team that cannot scale to every project, so risks are found late — or not at all.