Marisa Fagan - Measuring Security Culture
Om avsnittet
Security champions programs rarely fail because the idea is bad; they fail because organizations launch without management support, meaningful incentives, or a plan to prove value. Marisa Fagan, Head of Product at Katilyst and a veteran security-culture practitioner, shares a practical blueprint for piloting and scaling a program that lasts. She explains how to recruit and motivate champions using status, access, power, and stuff, why a pilot should produce both learning and a business case, and which anti-patterns quietly destroy trust. Marisa and the hosts also examine metrics for security culture, the role of qualitative evidence, and how champion models can extend to privacy and accessibility. The episode offers concrete guidance for building participation without turning volunteers into unpaid security staff.
The Application Security Podcast is brought to you by Security Journey.
About Security Journey
We provide application security training for not just your developers, but for all roles in your SDLC.
→ Learn more about Security Journey
Connect with Marisa Fagan:
→ Marisa Fagan on LinkedIn
→ Katilyst
Mentioned in this episode:
→ Security Champion Success Guide
→ OWASP Security Champions Guide
→ People-Centric Security
→ Katilyst
→ Kim Wuyts
Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook
Chapters:
00:00 Meet Marisa Fagan
03:02 What security culture means
05:44 Why security champions programs matter
08:36 Starting with organizational context
11:26 Recruiting the right champions
14:58 The components of an effective pilot
18:00 Turning a pilot into a business case
18:52 Motivating champions with SAPS
22:06 Status, access, power, and stuff
25:30 Common program anti-patterns
29:16 Chris's biggest champions-program mistake
32:15 Metrics that demonstrate success
35:02 Qualitative evidence and culture change
37:32 How security careers shape the advice
41:33 Creating space to share challenges
46:10 Beyond security champions
49:04 Closing thoughts
The Application Security Podcast med Chris Romeo and Robert Hurlbut finns tillgänglig på flera plattformar. Informationen på denna sida kommer från offentliga podd-flöden.