Consulting
We design, launch and run security champion programs that give champions real security work to own: threat models, design reviews, secure code and the evidence auditors ask for. We deliver them with our partner Katilyst, using its methodology, platform and resources.
30 minutes with a security champions specialist, no obligation.
A security champion program enlists developers, engineers and sometimes business staff as local advocates for secure practices. Champions bridge security and delivery teams: they help peers adopt secure coding, catch vulnerabilities earlier in the development lifecycle and build security into everyday decisions. They extend the reach of the central security team without adding headcount.
Based on the definition in Katilyst's State of Security Champions Report 2026.
A proven approach
Champions need clear practices to own: how to threat model a feature, what a design review checks, which findings block a release. Defining those practices and making them stick in engineering teams is the work SecureHabits has done for two decades.
Results of programs run on the Katilyst methodology, from katilyst.com, October 2026.
Who does what
Most champion programs stall for one of two reasons: champions lose motivation, or they're asked to own practices nobody defined. We handle the second, Katilyst handles the first.
How it runs
About three months to design, a year to launch, and the culture keeps building from year two. We run the program along Katilyst's three-phase arc; here's what SecureHabits delivers in each phase.
Months 1 to 3
With Katilyst, we set the program's vision and goals. We map the security activities champions will carry to your SSDLC and OWASP SAMM practices, and define the technical measures that show progress.
Year 1
Champions are recruited and onboarded. We run the technical onboarding sessions, facilitate the first threat models with champions, and set up the practices they'll own, such as design reviews, dependency hygiene and security testing.
Year 2 onward
The program reaches more teams and deeper skills. We add advanced tracks, measure engineering maturity with OWASP SAMM, and link champion activities to the evidence the EU Cyber Resilience Act asks for, where it applies to your products.
What works
Katilyst's second annual report surveyed 34 program owners and security leaders between January and August 2026. The sample is small, so treat the findings as directional, but three of them shape how we design every program.
90% vs. 25%
Programs that secure more than two hours of champion time a month report that 90% of them stay engaged. At two hours or less, 25% do. We design programs around two to four hours a month and help you agree that time with engineering managers.
44% vs. 24%
Programs the organization counts on to meet its security goals report 44% active participation, against 24% for programs with goals of their own. We connect champion activities to your SSDLC roadmap, OWASP SAMM targets and CRA obligations, so the program sits inside the strategy.
3.7 vs. 2.9
Measuring impact is the hardest challenge for the second year running, rated 4.0 out of 5. Programs that track security posture measures rate their effectiveness 3.7 against 2.9 for those that don't. We define posture measures during design, not after the first budget review.
Partnership
Katilyst designs culture programs that motivate the people who build software to own product quality and security. Security champion programs are its flagship.
SecureHabits is Katilyst's implementation partner for security champion programs. We follow the Katilyst methodology and use its platform, tools and resources, so your program gets a tested structure for recruiting, motivating and recognizing champions alongside our security depth.
“The gamification and configurability let you customize and create a program that leverages your company culture.”
Live sessions
One-hour talks and half-day or full-day workshops, onsite or online, tailored to your stack, policies and culture. A selection:
Our team works on OWASP SAMM, ISO/IEC 27034 and the CEN/CENELEC EN 40000 standards for the CRA, so champions learn practices that hold up in an audit.
Katilyst brings change management and behavior design, so new practices outlast the launch campaign.
Culture and security are designed together, with one roadmap and shared measures.
Teams we've worked with
Plan for two to four hours a month per champion. In Katilyst's 2026 State of Security Champions Report, 90% of programs that secure more than two hours a month report engaged champions, against 25% of programs asking for two hours or less. Most programs (55%) ask for two to four hours.
Design takes about three months: vision and goals, engagement strategy, launch roadmap, metrics and tooling. The launch runs through the first year, when champions are recruited, onboarded and recognized. From year two the program scales to more teams and deeper skills. Katilyst plans programs over three to five years.
You do. Katilyst designs and can run the program mechanics, SecureHabits delivers the security practice and technical content, and your program owner stays in charge of goals and priorities.
Yes. You can start with a pilot group of champions or a single onboarding series, and expand once the first results are in.
Both. Sessions run online or onsite and are tailored to your tools, policies and culture. See the full list of sessions.
It depends on the program scope, the number of champions and the sessions you choose. Book a call and we'll put together a proposal.
30 minutes with a security champions specialist, no obligation.