APPSEC Cali 2018 - Decrease Your Stress and Increase Your Reach with Appsec Champions

## Overview

Colleen, a security leader with experience since 2005 who built AppSec programs at Twilio (growing the team from 3 to 17 people) and Segment, presents strategies for leveraging AppSec Champions—developer advocates—to scale security programs beyond what a small security team can accomplish alone.

## The Problem

Many well-resourced companies still fail at security, not due to lack of funding but due to over-indexing on "checkbox compliance" rather than meaningful security culture change. Security teams often work in isolation, with developers avoiding consultations, scan results ignored, and AppSec audit failures. The core issue: the traditional security-versus-developers model is broken.

## Why AppSec Champions Matter

People are both the biggest security concern and the biggest asset. By converting developers into security champions, organizations reduce security team burden and ensure developers are included early in solutions. This is critical because fast-moving teams shipping multiple times daily will defeat security controls if not engaged as partners.

## Key Pieces of the Plan

**Prerequisites:** - Create a visual roadmap showing quarterly/annual goals - Secure budget for the program (training, rewards, conferences) - Document the AppSec Champion role and responsibilities - Identify potential champions (often self-select via security discussions or Slack activity) - Consult managers about capacity before recruiting champions

**Working with Champions:** - Establish bi-weekly or regular cadence meetings - Provide relevant, contextual training on actual vulnerabilities your team faces - Explain why specific flaws matter; teach prevention rather than just fixing - Gather feedback on workload and program effectiveness - Provide active mentoring when champions get stuck - Reserve space in your own sprint for champion support

**Signs the Program Works:** - Champions proactively influence their teams to complete security reviews - Teams schedule threat models and security work without prompting - Teams consult security before major architecture changes - JIRA tickets assigned to champions are fixed promptly - Fewer urgent AppSec incidents occur

## Rewards and Recognition Strategy

Since champions perform extra unpaid work, intentional rewards must align incentives with AppSec goals. Colleen recommends sprinkled rewards throughout the year:

**No-Budget Recognition:** - Call-out in performance reviews - Speaking spot at company All Hands - Public recognition from executives

**Budgeted Rewards:** - Conference attendance (Black Hat, DEF CON, APPSEC USA) - Exclusive branded merchandise (t-shirts, stickers via Spreadshirt or Makestickers.com) - Meetup attendance for security networking - Physical awards (e.g., Colleen gave a replica Charles V shield costing ~$75-80 to a high-performing team at Twilio)

**Quarterly/Spot Awards:** - Casual lunches - Exclusive team swag - Stickers with designs like "I do what security tells me" or "Security drinks with me because I'm that good" - Small gift cards - Unexpected public praise

Colleen emphasizes that meaningful recognition often costs little; people seek acknowledgment, especially when their regular work is mundane.

## Scaling and Remote Considerations

- Each AppSec engineer can manage approximately 6 champions maximum (meaning 6 teams covered) - For remote developers, use video chat and stagger meeting times to accommodate global schedules - Implement cascading meetings: champion meets with security, then holds separate meeting with their team to share information

## Champion Selection

Champions need not have formal security training. Look for developers who: - Voluntarily post security articles or breach news in Slack - Show genuine curiosity about security - Are respected tech leads - May initially resist but can be converted through engagement

Colleen notes that feared "Yolo developers" often become champions, while ostensibly careful developers may push back.

## Positive Outcomes

Beyond roadmap completion, a thriving program results in: - Developers invested in security and unwilling to let the team down - Continued progress even during security lead vacation - Champions actively advocating for the security team - Cultural shift, even among formerly hostile technical leads - Long-term relationships and community around security

## Key Takeaways

Security is like a religion; the security leader must create "disciples" to avoid preaching to an empty room. Invest in prerequisites (plan, budget, role clarity, champion identification), provide regular contextual training, mentor actively, reserve sprint capacity for support, reward intentionally and frequently, and trust your champions to advocate and drive cultural change.