Start with the right expectation or you'll burn it out before it proves its worth
Ant Davis
What a champions network actually is (and isn't)
Most champions networks fail before they really get started. Not because of poor execution and not because the wrong people were recruited, but because the expectations going in were completely disconnected from what a champions network can realistically deliver.
So before we talk about how to build one, let's talk about what it actually is.
What it isn't
A champions network isn't a training programme with a badge at the end. It isn't a group of people who become mini security experts overnight. It isn't a formal governance structure with terms of reference, quarterly reporting, and KPIs from day one. And it definitely isn't something you launch with a big announcement and expect to stay alive on enthusiasm alone.
If you go in expecting any of those things, you'll be disappointed. And more importantly, the people you recruit will be disappointed. Disappointed volunteers don't stay volunteers for long.
What it actually is
At its simplest, a champions network is a group of people across your organisation who have a slightly stronger connection to security than their colleagues. That's it. That's the foundation.
My old CTO described it as a spy network and I've always liked that framing. Not because there's anything sinister about it, but because it captures what you're actually building. You want people out there who notice things, who tell you what's going on in their part of the business, who quietly amplify your message in places you can't reach, and who give you signals back about what's landing and what isn't.
That's really valuable. And it's something a solo practitioner can build and sustain even with limited time and resources.
Scale doesn't matter as much as you think
Seven or eight years ago when I worked for a large UK retailer, I put off building a champions network. I was convinced our organisation wasn't ready. That we weren't big enough. After discussing it with my CISO, we didn't think I had the time, budget or resources to build it effectively.
I was very wrong.
Even in a small organisation, two or three contacts in different parts of the business who have an increased connection to security changes what you can do. You have eyes and ears in places you don't sit. You have people who can echo your message in team meetings you're not invited to. You have relationships that give you early warning rather than post-incident regret.
The network scales with your organisation. Start with what's possible and build from there.
The maturity journey
A champions network isn't a destination. It's a journey with different stages.
You start by making friends. Genuinely. I even called my old champions network Cyber Friends.
The first stage is not about outputs or metrics or formal structures. It's about building relationships with people across the business who are curious about security and willing to be a friendly contact. Low expectation, low commitment, high value.
From there you identify the ones who are genuinely engaged. The ones who show up, who ask good questions, who start to take on a bit more. Those are your lead champions. You invest more in them, give them more context, more tools, more visibility. They become something closer to extended team members.
That journey doesn't happen in a quarter. It happens over months and years, and that's fine. A network that's been quietly growing for two years is worth more than one that launched with a fanfare and went quiet by month four.
The one thing to take away
Start with the right expectation and you give yourself a genuine chance of building something that lasts. Expect too much too soon and there's a good chance you'll burn out your volunteers and your own enthusiasm before the network has had a chance to prove its worth.
