一句话：通过64周纵向案例研究，提出项目导向的BAGs以提升Security Champion的参与度与凝聚力。
许多组织，尤其是开发资源有限且安全专家较少的组织，难以开发安全软件。Security Champion 项目是一种可扩展策略，但其建立与维持常遇到参与度和专业水平不一、与其他职责冲突以及缺乏指导等挑战。本文与一家拥有5000多名员工、约200名软件开发者的组织合作，对其 Security Champion 项目进行64周分析，研究从双周会议转向项目导向、每月会议的 breakout action groups（BAGs），并记录安全编码工作坊，通过回顾评估进展并观察项目愿景声明制定。结果显示，BAGs 提升了安全冠军的参与度和积极性；愿景工作坊和回顾增强了群体凝聚力、使命一致性和项目可见性。文章还讨论了BAGs及相关举措的潜力与局限。
Many organizations, particularly smaller ones with limited development resources and few security experts, face major difficulties in developing secure software. Security Champion programs are a scalable strategy for strengthening security practices throughout the software development process. However, previous work has shown that establishing and maintaining such programs often entails currently unsolved challenges, including varying levels of engagement and expertise among champions, conflicts with other organizational responsibilities, and a lack of guidance on addressing these issues. In partnership with an organization employing over 5,000 employees, including approximately 200 software developers, we documented its efforts to address the challenges faced by its Security Champions through multiple initiatives and formats. We attended and analyzed the organization's Security Champion program for 64 weeks. Within this study, we investigated transitioning from bi-weekly Security Champion meetings to a project-focused group format, which we called breakout action groups (BAGs), with monthly meetings. Additionally, we documented secure coding workshops, evaluated progress through retrospectives, and observed the development of a vision statement for the program. Our results show that the BAGs enhanced Security Champions' engagement and motivation. In addition, the vision workshop and the retrospective fostered stronger group cohesion, aligned champions toward a shared mission, and increased the program's visibility within the organization. We further discuss the potential and limitations of BAGs as well as the initiatives for Security Champion programs.
@inproceedings{OpdenbuschSSG26,
title = {Enabling Security Champions With Breakout Action Groups (BAGs) – A Longitudinal Case Study},
author = {Jens Christian Opdenbusch and Sangavi Shanthakumar and M. Angela Sasse and Marco Gutfleisch},
booktitle = {FSE},
year = {2026},
doi = {10.1145/3803437.3805215}
}