How will we motivate the participants to perform the Ideal Actions? This is where the rubber meets the road! It’s time to take everything you now know about the target Participants, the current Setting, and the Ideal Future State and engage your creativity to brainstorm and finalize methods to encourage and incentivize your Champion’s behavior.

Define Champion Types

We previously identified the different Participant Groups who will be involved in our program. We can follow this structure to come up with different types of Security Champions as in the following example. It’s also good to list the topics that would be most interesting to the different types so you can be sure to design your program around delivering relevant training and content.

Program Structure

Decide on how you want to structure the program. I’ve added a few questions for consideration, along with recommendations based on my experience, but feel free to make the program your own and take a different direction.

• How will you build trust and provide value to the Champions?
  • At its core, interactions with the Champions must be genuine and sincere. You must strive to help them grow and learn in their cybersecurity knowledge. Ensure all interactions with them express this.
• How will you train your champions?
  • Brown Bags: I recommend having a monthly meeting or “brown bag” as this is a great opportunity to get all your Champions together and present training topics tailored for the audience and culture. This gets everyone on the same page as far as best practices and recommended habits. Due to the different Champion Types you may consider having multiple options for meetings every month for the Champions can choose from, like this:
    • One meeting per month focused on Software Security Champion topics, alternating between technical and business topics month-to-month.
    • One meeting per month focused on Security Awareness Champions, alternating between technical and business topics month-to-month.
• Volunteer or Voluntold?
  • You want people who are excited and desire to join because of their own intrinsic motivation. It is not recommended to remove this choice by assigning them the role without vetting their willingness and excitement to engage.
  • Unless you’re prepared to make this an official position with additional pay, people won’t appreciate being assigned additional responsibilities. Note that if you do desire to make being a Champion an official position, most of the methods explained in this guide are not necessary as it was built to help encourage voluntary behavior. An official Security Champion role will be subject to the same rules and policies as with other official positions (job description, performance reviews, etc.).
• Require leadership / manager approval?
  • It’s important for the Champion’s supervisor to be on board with the program and okay with their report spending time on it. Without this, the supervisor may be concerned and even interfere with their report’s ability to participate. It’s also a great idea to have the supervisor reach out to those who they think would be good for the program and invite them to participate. This can be a motivating factor for the report to feel they were “chosen”, their manager believes in them, and supports their involvement. This is not an assignment as the nominee can still choose whether to sign up.
• Who is eligible to be a Champion?
  • Do they have to earn their way in somehow or is it open to anyone who volunteers? In my experience, it’s best to remove initial barriers of entry and let in anyone who volunteers. You can always restrict some things (invitations to events, usage of tools like Burp, etc.) to only those Champions who have earned their way to have certain privileges. Example: anyone can be a champion, but only those who have earned it will be invited to the capture the flag event.
• How many Champions in an area?
  • Ideally you should strive to have one Champion among every group of people who work closely together. This could be defined as an organizational team (everyone who reports to the same supervisor), a scrum team, or some other informal team or larger collection of people. Ultimately it’s best to work with the leadership of the org where you’re trying to recruit to determine the best way to structure Champion support in their org.
  • No limit: If there’s already a champion on the team, but someone else wants to volunteer, why would you turn them away?? As long as their supervisor supports it, they should be welcome. An advantage to having more than one is to cover for each other in case one cannot make a Champion meeting, etc.
• How will you keep in touch with your Champions?
  • Having a dedicated Slack or Teams channel is a great way to create a community where Champions can interact with each other as well as the security team. It’s also very useful for announcements about meetings as well as recognizing the efforts and achievements of the Champions among the larger group.
• What will be their responsibilities and estimated time commitment?
  • Initial phase time commitment should be low to not cause concerns about time or the ability to perform normal job duties. The actions and activities performed by the Champions should always be optional and not required.

Motivational Methods

How do you motivate your champions? What are some specific techniques to engage the participants and prompt them to perform the Ideal Actions you’ve defined? This is a great chance for you to be creative. The more fun you have in designing the experience of your champs, the more fun they are likely to have as well. So gather around a (virtual) whiteboard with your Steering Team and come up with ideas! At this stage, don’t worry about finalizing anything, just throw your thoughts out there. It’s recommended to use human-focused motivational design (aka “gamification”) techniques, such as those I mention in my RSA 2023 talk on Building an Engaging Security Champion Program.

The motivational techniques you ultimately use should be specific to what you believe will work for your culture, keeping in mind how your Participants will react given their current motivations as captured in the Setting step. Below is an example that has been tailored over years of experience in building Security Champion programs and I’ve explained the reasoning behind the methods described.

Note that the above methods are just for an initial phase of a Champion program, align with Example Goals 5, 4, and part of 3, and are tailored to encourage the initial phase Example Ideal Actions. I’ll share an example of a later stage design in the future.

Try not to think about how you will implement these methods at this stage as it may stifle your creativity. Focus on what an ideal experience for your Champions looks like. You’ll work out the implementation details in the Delivery phase. These ideas have been proven to work in my experience, but there may be better motivational methods to incentivize your Champions based on your company’s unique culture and norms. I’d be curious to know what methods you come up with, if you’d like to share!

Rewards

What specific rewards and incentives could be used in the program? Define the details of rewards and how they align with the Motivational Methods.

To help brainstorm, think of different types of rewards using the acronym SAPS:

As you can see, these are beyond just material rewards. The beauty of SAPS is that the categories are in the order of effectiveness, but in reverse-order of cost. This means, in general, the most effective rewards are typically the cheapest to implement!

This reward model won’t apply to all Champions. Some may consider certain rewards to be more important to them than others.

Use your creativity here and follow SAPS to come up with new unique ideas. I’d love to hear what you come up with.

Finalize Design

Take the ideas you’ve generated and refine the design. Put yourself in the Champions’ shoes and really think about their experience, taking into account how the Champions will react to the different rewards. You’ll also want to ensure you’ve aligned your Motivational Methods and rewards with what you came up with in the Concept phase, and also that they’re a step toward accomplishing the Goals you set in the Vision phase. You also should consider your Participants, and the current Setting of your program.

Once you have a design you are excited about, it’s time to settle on the details of how the different Motivational Methods work together. For instance, collecting Stars leads to attaining a Belt Level, but just how many Stars does one need to increase in level? I’d suggest adding to the Design Spreadsheet you started in the Concept phase and expanding it to include the finer details about stars or whatever gamification elements are used in your program.

Finalizing Leveling Systems

When implementing a leveling system, it is wise to graph the level progression to ensure it’s easy at first, becomes more challenging, then flattens off to ensure the higher levels feel attainable. Calculating stars earned by below-average, average, and above-average achievers can help determine the right amount of stars required for each level. The majority of your Champions should be in the middle levels to respect a normal distribution “bell curve” of stars likely to be gained by the Champions.