Marisa Fagan - Measuring Security Culture

Security champions programs rarely fail because the idea is bad; they fail because organizations launch without management support, meaningful incentives, or a plan to prove value. Marisa Fagan, Head of Product at Katilyst and a veteran security-culture practitioner, shares a practical blueprint for piloting and scaling a program that lasts. She explains how to recruit and motivate champions using status, access, power, and stuff, why a pilot should produce both learning and a business case, and which anti-patterns quietly destroy trust. Marisa and the hosts also examine metrics for security culture, the role of qualitative evidence, and how champion models can extend to privacy and accessibility. The episode offers concrete guidance for building participation without turning volunteers into unpaid security staff.The Application Security Podcast is brought to you by Security Journey.About Security JourneyWe provide application security training for not just your developers, but for all roles in your SDLC.→ Learn more about Security JourneyConnect with Marisa Fagan:→ Marisa Fagan on LinkedIn→ KatilystMentioned in this episode:→ Security Champion Success Guide→ OWASP Security Champions Guide→ People-Centric Security→ Katilyst→ Kim WuytsFollow the Application Security Podcast:➜ Home➜ X➜ LinkedIn➜ YouTube➜ Instagram➜ FacebookChapters:00:00 Meet Marisa Fagan03:02 What security culture means05:44 Why security champions programs matter08:36 Starting with organizational context11:26 Recruiting the right champions14:58 The components of an effective pilot18:00 Turning a pilot into a business case18:52 Motivating champions with SAPS22:06 Status, access, power, and stuff25:30 Common program anti-patterns29:16 Chris's biggest champions-program mistake32:15 Metrics that demonstrate success35:02 Qualitative evidence and culture change37:32 How security careers shape the advice41:33 Creating space to share challenges46:10 Beyond security champions49:04 Closing thoughts