Uploaded December 2025 | Updated September 2026, 2 weeks ago
Many organizations grapple with how to effectively scale Security Champion programs beyond initial awareness efforts. While the concept is popular, the path to sustained engagement and measurable impact at an enterprise level often remains unclear.
This talk will share the lessons learned from running a program that supports nearly 800 Security Champions at a large software organization that serves over 60% of the Fortune 500 companies and has more than 11,000 customers worldwide.
Our experience shows that Security Champions programs are most effective when organizational and participant incentives are aligned to co-create security tools, processes, practices, and an ever-present security culture.
From an operational perspective, our program serves as a gamification success story where participant contributions are measured by their impact and recognized using a flexible framework that any organization can adopt.
Hernán Palombo
Workday
Principal Cybersecurity Engineer
Dr. Hernán Palombo is a seasoned security leader, engineer, and researcher with nearly 15 years of experience in the field. He currently leads Workday's Security Champions Program, supporting nearly 800 engineers across over 500 teams. His research includes one of the longest ethnographic studies on security culture to date, and his earlier works, featuring formal models of security, were published in top peer-reviewed conferences. Hernán earned his Ph.D. from the University of South Florida for his work on "Models of Secure Software Enforcement and Development," where he also taught Computer Science and Security courses.
linkedin.com/in/hernanpalombo
Managed by the OWASP® Foundation
owasp.org
Many organizations grapple with how to effectively scale Security Champion programs beyond initial awareness efforts. While the concept is popular, the path to sustained engagement and measurable impact at an enterprise level often remains unclear.
This talk will share the lessons learned from running a program that supports nearly 800 Security Champions at a large software organization that serves over 60% of the Fortune 500 companies and has more than 11,000 customers worldwide.
Our experience shows that Security Champions programs are most effective when organizational and participant incentives are aligned to co-create security tools, processes, practices, and an ever-present security culture.
From an operational perspective, our program serves as a gamification success story where participant contributions are measured by their impact and recognized using a flexible framework that any organization can adopt.
Hernán Palombo
Workday
Principal Cybersecurity Engineer
Dr. Hernán Palombo is a seasoned security leader, engineer, and researcher with nearly 15 years of experience in the field. He currently leads Workday's Security Champions Program, supporting nearly 800 engineers across over 500 teams. His research includes one of the longest ethnographic studies on security culture to date, and his earlier works, featuring formal models of security, were published in top peer-reviewed conferences. Hernán earned his Ph.D. from the University of South Florida for his work on "Models of Secure Software Enforcement and Development," where he also taught Computer Science and Security courses.
linkedin.com/in/hernanpalombo
Managed by the OWASP® Foundation
owasp.org
