State of Security Champions Report

We asked 34 program owners what a Security Champion program actually costs, how much time it takes, and what happens to engagement after the launch enthusiasm fades. The answers are free to read.

What we found

90%

Time decides engagement

Among programs securing more than two hours of Champion time a month, 90% report their Champions staying engaged. Below that line, 25% do.

Programs their organization counts on to meet security goals report 44% active participation, against 24% for programs sitting outside the strategy.

Measuring program impact rates 4.0 out of 5 for difficulty, the hardest challenge for the second year running, and it moved up from 3.9 in 2025.

Among programs that secure more than two hours of Champion time each month, 90% report that their Champions are staying engaged. Among programs asking for two hours or less, 25% do. It is the strongest relationship in our data, and it is stronger than anything budget produces.

Time is also the reason Champions disengage. Among programs reporting that engagement has faded, time management was cited four times as often as lack of budget.

FIGURE 20: Champions and Central Security Team per 100 Developers

FINDING TWO

Where the program sits predicts more than how big it is

Neither organization size nor Champion count shows a meaningful relationship with reported effectiveness. What does is position. Programs their organization counts on to meet security goals report 44% active participation, against 24% for programs sitting outside the strategy with goals of their own.

BSIMM16 points the same way from a different angle. Among the highest-scoring software security organizations there are 12.3 Champions per 100 developers and 2.7 central security staff. At the bottom, those numbers are 4.6 and 6.8. Expertise moves outward as programs mature.

Measuring program impact rated 4.0 out of 5 for difficulty, up from 3.9 last year. Yet programs tracking security posture measures report effectiveness of 3.7 against 2.9 for those that do not.

The shift shows up across program age. Security posture measures rise from 22% of programs under a year old to 88% of programs past their fourth year, while counts of bugs found and departments covered fall away. Early programs count what they can see. Established programs measure the posture of what they touch.

Most programs sit between Guided and Integrated

Standards exist and Champions are modelling them. Far fewer programs have moved those checks into daily engineering workflows. The report reads every finding against this model and closes with the specific next move at each stage.

The Current State: who runs Champion programs, how far they reach, and what they focus on. The Investment Question: what programs cost in budget and in time. No one has published this before. Running the Program: structure, engagement, recognition, measurement, and what owners find hardest. Benchmarks and Playbooks: our data compared against BSIMM16 and Layer 8, and the next move at each maturity stage.

34 respondents, 33 with an active program 37 questions, up from roughly ten in 2025 Fielded January – August 2026, covering calendar year 2025 Every cohort figure carries its sample size. Small sample; findings are directional rather than statistically representative, and we say so throughout.

Answer ten questions in about two minutes and get your next three moves, based on this year's findings

Forty pages, twenty-two figures, and the full methodology. Useful when you are making the case internally and need something to send round.

I'd like to receive the latest research and future Security Champion reports.

The seven-step process behind the maturity model, published openly.

The first edition, and the baseline every year-over-year comparison in this one is drawn against.

An objective read on where yours stands, with a roadmap for what to fix.