Cybersecurity Awareness Month is when security champions earn their keep. If you've got a network, this is the moment they can multiply your reach. If you don't, it's the best time of year to start building one.
Last week I sat down with Sarah Janes from Layer 8 for a live session on the Secure Culture Hub. Sarah has spent twelve years building champions and ambassador programmes, and she opened the session with a question that had nothing to do with cybersecurity on the surface: what's the best thing that's happened to you today.
There's a reason behind that question. It's a small piece of a change methodology called appreciative inquiry, and it shaped everything else we talked about.
What appreciative inquiry actually is
Appreciative inquiry is a change approach built on five principles. Change is socially constructed, meaning people shift behaviour through conversation and observation rather than by reading a policy. Where you focus your attention grows, so a deliberate focus on what's working builds more of what's working. Language creates reality. Positive framing generates momentum in a way that risk-focused framing doesn't. And relationships sit at the centre of all of it.
For security awareness practitioners, this flips the usual instinct. We're trained to hunt for risk and weakness. Appreciative inquiry asks you to go looking for what's already going right, and to use that as the foundation for change instead.
Sarah walked through this using the four D model: discover what's already working and why, dream about what it would look like if that were true across the whole organisation, design the programme that gets you there, and deliver it.
Ideas for recruiting champions
If you don't have a network yet, or you're rebuilding one, start by asking your security team to nominate people. Not security experts. People who ask good questions, who help colleagues out, who notice when something looks off. Sarah calls this exercise "Security Stars," and it works because it surfaces the connectors and influencers already inside the business rather than waiting for volunteers to find you.
A second option is "Could This Be You." Take someone already showing strong security habits, ideally someone in a non-technical role like HR or finance, and get them to talk for a few minutes about what they do and why they got involved. It shows the rest of the business that a champion can be anyone willing to talk and willing to protect the organisation.
I built my own champions network on a similar principle. The job description was deliberately thin: someone curious, someone who could communicate both ways. My CTO at the time described it as a spy network, which wasn't far off. Ear to the ground, but with the confidence to bring things back to us. We ran a light marketing push, a few posters, some video, a mention at a town hall, and it grew organically from there because people enjoyed the conversations enough to keep having them.
Ideas for a new or newly reinvigorated network
New champions often sit in a passive state. They show up, they listen, they learn, but they don't act. The job here is to give them small, low-risk ways to start talking.
One option is a single open question they take to their team, something like "is there a security practice that actually helps you do your job safely." Capture the responses, and follow up not just on what people said but on how the conversation felt. Sarah's point is that even a single low-stakes exchange starts breaking down the barrier to having more of them.
A treasure hunt works the same way. Ask champions to go and find good examples already happening in their team. Strong passwords in use. People reporting suspicious emails. Materials labelled properly. You're not asking them to police anything. You're asking them to notice.
The AI detective challenge
This one's worth running on its own. Most organisations are moving fast on AI and most security teams are still working out the rules as they go, which makes it hard to have a clean conversation about what's allowed. An AI detective challenge sends champions out to find out how AI is actually being used across their teams right now, what misconceptions are floating around, and where the fear or confusion is sitting.
I've heard this from practitioners constantly this year, including at SANS Summit in Vegas. Shadow AI and AI adoption are the two things nearly everyone is wrestling with, and AI is now showing up inside every tool people touch. Giving champions a structured way to surface what's actually happening, rather than guessing at it from the security team's side, is one of the more useful things you can do with the network this month.
Getting champions active, and keeping them that way
Make participation as low-friction as possible. A five-minute task and a forty-five-minute task should both exist, so champions can match effort to whatever time they've actually got. Pre-built packs help here too, a ready-made question, a channel to drop the answer in, a clear instruction on what you're actually asking for.
Once you've collected what champions bring back, don't let it sit unused. Bring it into a session, show them what came out of their conversations, and use it to shape what the network does next.
Reward, without the gamification trap
Champions tend to volunteer for one of two reasons. A genuine wish to help their organisation and colleagues, or a wish to be seen doing something good by their peers and managers. Both are worth designing for, and public recognition costs very little.
Sarah's caution here is an important one. Reward the behaviour you actually want, not the act of joining. A cool T-shirt gets people to sign up. It doesn't get them to stay active. If you're using points or levels, model the maths carefully so people can't game their way to the top through low-effort repetition.
I'd add a caution of my own. League tables and public leaderboards can create a competitive, one-player dynamic that leaves quieter champions, or ones without a big network of their own, feeling overlooked even when they're doing valuable work. A mentor tier, recognising the champions who naturally end up supporting others, can be a gentler way to build hierarchy without the gamification downside.
Sarah's own experience running award ceremonies, with no points and no physical prizes, just public recognition in front of senior leadership, has worked as well as anything more elaborate.
Where does your network sit today
Sarah closed with a champions maturity model built around six factors: strategic alignment, shared vision and values, learning and development, career pathways, reward, and coverage. The strongest programmes tie champion activity directly back to the organisation's actual risk priorities, which makes the impact easier to measure and easier to defend when it's time to ask for more resource.
Her advice for anyone just starting out is the same advice I'd give: start small, start with the people who actually want to be involved, then sit back and look at what happened before you decide where to grow next.
The full recording of the session is at the top, including the live Q&A and a few extra examples that didn't make it into this write-up.
