The obvious volunteers aren't always the ones who'll move the dial
Ant Davis
Recruiting the right champions: willing vs influential
When I built my first champions network I did it with whoever put their hand up.
I sent an email to the whole organisation, featured it in my newsletter, and put a post on the main announcements channel on Slack. The people who responded were the ones who were already interested in security, already engaged, already doing the right things.
They were valuable. But by only recruiting that way, I missed the people who would actually have the most impact.
The difference between willing and influential
There's an important distinction between someone who wants to be a champion and someone whose involvement would genuinely change things.
Willing people are surprisingly easy to find. They come to you. They're enthusiastic, they complete the training, they show up to the sessions. Then they go back to their teams and talk to the same small circle of colleagues who were already fairly engaged.
Influential people are harder to find. They don't always put their hand up because they don't think of themselves as security people. But they're the ones their colleagues actually listen to. The informal leader people go to when they have a question. The person whose opinion shifts a room. Someone who models behaviour that others follow, not because they're told to but because that's just how they operate.
That's the person you want in your network. Finding them requires a different approach.
How to find your influencers
You're not going to find them by posting on the intranet. You find them by asking the right questions to the right people.
Talk to managers and ask who in their team others look to when they're unsure about something. Ask who tends to set the tone informally, who people go to when they want an honest opinion rather than an official answer.
Pay attention in town halls and all-hands meetings. Who is asking good questions? Who do people turn to look at when something is said? Who speaks up in ways that others seem to take seriously?
Ask your existing contacts too, the people you've already been building relationships with in that informal phase. They know who the influential people are in their part of the business.
And watch how people behave naturally. Who already models the kind of security behaviour you want to see? Who notices things and mentions them without being asked? Those people exist in most organisations. You just haven't noticed them yet.
The recruitment conversation
Once you've found someone you want in the network, the conversation is different from a standard recruitment pitch.
You're not asking them to sign up to a programme. You're telling them something specific about why you've sought them out. You've noticed they're someone people listen to, or you've seen how they operate, and you think their perspective and occasional support would be genuinely valuable. You'd like to have a conversation about whether that's something they'd be interested in.
That's a very different ask from "we're looking for security champions, would you like to get involved?" One is a generic call for volunteers. The other is a targeted, personal approach that tells someone their specific qualities are valued.
Most people respond well to being recognised for something real. It's not flattery. It's an accurate observation about why you're talking to them specifically.
Branding your network
One thing worth thinking about before you start recruiting at scale is what you're asking people to be part of.
A name matters. "The Security Champions Network" sounds like something IT runs. Think about what would make people proud to be associated with it. What would make it feel like something worth joining rather than something they've been volunteered for?
Look at how other networks in your organisation brand themselves. Pride networks, mental health ambassadors, wellbeing groups. They all have names and identities that people feel good about. Your network can do the same. A strong name and a clear identity gives potential champions something to connect with and makes the network feel like a peer to initiatives the organisation already values.
This is a practical recruitment tool too. People talk about things they're proud of. If your network has an identity worth talking about, your champions will recruit for you.
You need both
The strongest networks have a mix. The willing people who came forward because they care, and the influencers you went out and found. They bring different things.
The willing people tend to be more consistent, more engaged, more likely to do the work of attending sessions and completing tasks. The influential people tend to have more reach, more credibility with their colleagues, and more ability to shift culture rather than just talk about it.
You need both. Don't neglect either.
Don't just recruit the obvious ones
Recruitment is where a lot of champions networks quietly set themselves up to fail. Not because they recruited bad people, but because they only recruited the obvious ones.
Go looking for your influencers. Have targeted conversations. Build a network that has reach as well as enthusiasm. If you do that, you'll have something that can actually move the dial.
