Uploaded December 2025 | Updated September 2026, 2 weeks ago
Security culture and champion programs are often praised, but rarely measured effectively. When it’s time to secure headcount or budget, how do you prove your initiatives are actually working?
In this session, a longtime AppSec leader and champion program designer will share a practical, battle-tested approach to measuring the impact of security culture and developer engagement. You’ll learn how to track key behaviors across the SDLC, correlate culture efforts with tangible security outcomes, and speak the language of both developers and executives.
We will cover how to select metrics that reflect real improvement, including examples tied to threat modeling, remediation velocity, and team trust. We'll also discuss tips for starting small, running A/B tests, and using early success to influence leadership buy-in.
Whether you’re just starting your program or scaling it up, you’ll leave with a data-informed strategy that resonates.
Dustin Lehr
Katilyst
Application Security Advocate, Security Journey / Co-founder
Dustin Lehr is Director of Application Advocacy at Security Journey and Co-founder of Katilyst. As a former software engineer and Cybersecurity leader, he now helps build developer-centric AppSec programs that motivate and incentivize security-minded behaviors. He is also the author of the Security Champion Program Success Guide and co-leads the Let’s Talk Software Security global open discussion community.
linkedin.com/in/dustinlehr
Managed by the OWASP® Foundation
owasp.org
Security culture and champion programs are often praised, but rarely measured effectively. When it’s time to secure headcount or budget, how do you prove your initiatives are actually working?
In this session, a longtime AppSec leader and champion program designer will share a practical, battle-tested approach to measuring the impact of security culture and developer engagement. You’ll learn how to track key behaviors across the SDLC, correlate culture efforts with tangible security outcomes, and speak the language of both developers and executives.
We will cover how to select metrics that reflect real improvement, including examples tied to threat modeling, remediation velocity, and team trust. We'll also discuss tips for starting small, running A/B tests, and using early success to influence leadership buy-in.
Whether you’re just starting your program or scaling it up, you’ll leave with a data-informed strategy that resonates.
Dustin Lehr
Katilyst
Application Security Advocate, Security Journey / Co-founder
Dustin Lehr is Director of Application Advocacy at Security Journey and Co-founder of Katilyst. As a former software engineer and Cybersecurity leader, he now helps build developer-centric AppSec programs that motivate and incentivize security-minded behaviors. He is also the author of the Security Champion Program Success Guide and co-leads the Let’s Talk Software Security global open discussion community.
linkedin.com/in/dustinlehr
Managed by the OWASP® Foundation
owasp.org
