Thrifty Guardians: Overcoming the Challenges of Establishing Security Champions on a Limited Budget

In this case study conducted over a six-months period where a Security Champions team was established, and an additional month for the remaining data collection and analysis, we explore the challenges and strategies in forming and sustaining a Security Champion team in a mid-size software engineering organization, given a very limited budget. Our research questions focus on identifying the main challenges and key success strategies when establishing such a team, to enable security awareness, competence and focus, with cost-efficient approaches. The chosen research methodology consisted of an exploratory case study, involving 11 Security Champion team members and two key stakeholders. A mixed-method approach was used, collecting data via semi-structured interviews and an online self-assessment survey, further processed with structural coding to identify key success factors and challenges. Our study shows that it is possible to establish a Security Champion team on a strictly limited budget, given the following identified key success factors: the team leader possesses prior experience with the concept, the team have short but frequent meetings, there is buy-in from management, team members, and other security organizations, and there are enough situations where the Champions can apply their skills. However, challenges persist, including lack of clear goals, unclear prioritization, lack of internal support, lack of buy-in from other security organizations and efficient ways to utilize the Champions’ skills within their teams. This study contributes by identifying key success factors and challenges to mitigate, for organizations looking to establish a Security Champion team with limited resources.