Thought Leadership

In our last article, we followed an "Instant Return" feature through every phase of ShopFlow's agentic delivery pipeline. Autonomous agent squads parsed requirements, created rapid prototypes, generated code, ran chaos tests, and managed a feature release, while human professionals stepped in at the precise moments where judgment, accountability, and context were required. For many readers, the natural follow-up question was a practical one: how does an organization that runs

Last month I was in conversation with a security leader, walking through what a champion program actually does inside their engineering and security teams. Then I said the words "culture change," and I watched something close down. Not disagreement per se, but something that felt more tired. She said her organization had been through enough "change" initiatives lately and asked "could we talk about this differently?"

Technical teams need to shift from AI-assisted development (where AI lives lazily inside a code editor) to a fully Agentic SDLC; a framework where autonomous AI agent squads execute end-to-end development steps between tightly defined human review checkpoints. Let’s look at how that feature moves through the six core phases of the Agentic SDLC, mapping exactly how our redefined human roles work alongside automated agent squads.

We have entered what we call “The Builder Age,” where anyone with a clear vision, an understanding of user needs, and a grasp of basic system logic, is empowered to become a software builder. To remain competitive, enterprise technology leaders must understand how traditional engineering roles are morphing into higher-order orchestrator functions.

As inferential capabilities commoditize, the distribution of labor is undergoing a historic reorganization. To thrive, professionals, leaders, and parents must understand which roles are transitioning into automated infrastructure, which human-centric career paths are expanding, and how to future-proof the next generation.

The future of work is not a zero-sum competition between biological minds and silicon models. It is a profound invitation to reclaim the parts of our careers that make us most human.

The latest edition of the highly-regarded BSIMM16 report on the state of application security includes intriguing insights into the breadth and impact of Security Champion programs. With data from 111 firms gathered through in-person interviews and artifact reviews, the report offers a stark look at what separates the leaders from the laggards.

As we move toward 2026, Security Champion programs are shifting from "nice-to-have" culture initiatives to essential, developer-led engineering engines. The focus has moved beyond general "awareness" to deep technical integration, AI-assisted development, and proactive governance within the code itself. Our first blog this year highlights the emerging trends that are defining the next era of developer-focused Security Champions.

A Security Champions program turns employees from various teams into security advocates and liaisons. They act as a force multiplier, bridging the gap between security professionals and the broader organization. But as your program grows, how do you keep these champions motivated and their efforts visible? The answer lies in Engagement Design.

Every October, Security Awareness Month presents a golden opportunity for Security Champion program owners to energize their communities. Running creative, motivating events not only boosts awareness but also reinforces your champions’ role as advocates for secure practices across the organization. We’ve come up with a set of event ideas, complete with how to run them and tips for tying them into your program’s gamified structure.

Last month at DEF CON, Katilyst's CEO and co-founder, Stanley Harris, had the privilege of facilitating a 2-hour training workshop on Security Champion Program Design along with Tanya Janca. Bringing together practitioners, leaders, and curious first-timers from across the security and engineering community, our goal was simple: give attendees a clear, actionable path to build (or rebuild) a Security Champion program that truly works.

At Katilyst, we’ve found that the biggest barrier to strong threat modeling isn’t technical knowledge—it’s engagement. Even with the best frameworks (STRIDE, PASTA, etc.), teams tune out if threat modeling becomes a rote checklist. That’s why we set out to transform it into an epic quest. Inspired by tabletop RPGs like Dungeons & Dragons, our approach gives security champions the tools to lead fun, collaborative, and genuinely productive threat modeling sessions.

Through a combination of conversations and firsthand experience, we have developed a sixth sense about the mistakes that are most commonly made over the lifetime of a champion program which lead to failures.

In a recent webinar hosted by Wizer, Katilyst's Dustin Lehr joined Gaby Friedlander to explore the importance of cultivating a strong security culture through Security Champion programs.

The key to building security culture is motivating and inspiring your colleagues to take proactive action - focusing on the carrot, not the stick. This can be a lot of work, so we created Katilyst to lift the burden.

With employees dispersed across various locations, ensuring that everyone aligns to security best practices can prove a difficult challenge. In this week's post we explore some methods to build and maintain a strong security culture in remote work companies.

Hosted by Semgrep and led by Tanya Janca (one of our advisors and a close friend to Katilyst), the panel explored the critical elements of creating and maintaining a successful Champions program.

You'll find some great insights into why these programs exist and what champions do on a day-to-day basis.