Research & Case Studies

The latest edition of the highly-regarded BSIMM16 report on the state of application security includes intriguing insights into the breadth and impact of Security Champion programs. With data from 111 firms gathered through in-person interviews and artifact reviews, the report offers a stark look at what separates the leaders from the laggards.

As we move toward 2026, Security Champion programs are shifting from "nice-to-have" culture initiatives to essential, developer-led engineering engines. The focus has moved beyond general "awareness" to deep technical integration, AI-assisted development, and proactive governance within the code itself. Our first blog this year highlights the emerging trends that are defining the next era of developer-focused Security Champions.

Through a combination of conversations and firsthand experience, we have developed a sixth sense about the mistakes that are most commonly made over the lifetime of a champion program which lead to failures.

n today’s cybersecurity landscape, it's clear that technology alone cannot solve all our security challenges. Security culture plays a pivotal role, and this is where security champion programs come into the picture.