The best champions networks didn't start with a launch, they started with a conversation
Building a champions network: start by making friends
There's a temptation when you're building a champions network to make it feel significant from the start. A launch event, a formal name, a slide deck explaining the programme, maybe a badge or a certificate. It all feels like the right way to signal that this matters.
That's basically everything I considered when I started mine, and in my experience that approach creates more problems than it solves. You've set an expectation before you've built a foundation, and now you have to deliver against it.
The better approach is much simpler and far less glamorous. Start by making friends.
What making friends actually means
This isn't a metaphor. It's a literal description of what the first phase of building a champions network looks like.
You identify a handful of people across the business who seem curious about security, or who you've noticed are already doing the right things, or who someone you trust has mentioned as a go-to person in their team. And you go and have a conversation with them. Not a recruitment pitch, not a formal ask, just a genuine conversation about what they're seeing, what worries them, what they think the business gets right and wrong around security.
That conversation does several things at once. It gives you intelligence about what's actually happening in that part of the business. It signals to that person that their perspective matters. And it starts to build a personal relationship that you can develop over time.
At this stage you're not asking for anything. You're just listening. And listening is hugely underrated as a strategy.
What success looks like in this phase
You want two or three contacts in different parts of the business who know who you are, feel positively about you, and would pick up the phone if they noticed something worth flagging.
That's it. That is a successful first phase.
It sounds modest but it really isn't. If you're a solo security awareness practitioner with three genuine contacts in different business units, you now have eyes and ears in places you'd never have otherwise reached. Those contacts know what's causing friction, what people are actually worried about, what messages are landing and which ones aren't. That intelligence is worth more than a formal network of twenty people who signed up and then forgot about it.
Your intelligence network
Your contacts are not advocates yet. They're not champions in any formal sense. They're people who have a slightly stronger connection to you and to security than their colleagues. Think of them as a quiet intelligence network. A small group of people who notice things, mention things, and ask questions.
And occasionally, when you need a message to reach a part of the business you can't get to directly, you can ask them to echo it. Not as a task or an obligation, but as a favour between colleagues who have a decent relationship.
That's the foundation. Everything else builds on top of it.
Don't rush the next stage
The temptation at this point is to formalise things. Give it a name, set up a group, start sending out a newsletter. Resist that until you're genuinely ready.
Formalising too early locks in a structure before you know what the network actually needs. It creates administrative overhead that eats into the time you should be spending on relationships. And it can signal to your contacts that the casual, low-pressure dynamic is changing, which may put some people off.
The right time to formalise is when the informal network is already working well and you're ready to invest more in it. Not before. You need to prove the concept works and make sure you're building in the right direction before you go big.
Let it grow
The most durable champions networks I've seen didn't start with a launch. They started with a conversation. And then another conversation. And then another. And gradually, quietly, they became something the organisation couldn't imagine being without.
Start there. Go and make friends. Let it grow at the pace it needs to grow.
