Most organizations have security champions. Few have a real security culture.

In this episode of AppSec Contradictions, Sean Martin explores why AppSec awareness efforts stall, why champion programs struggle to gain traction, and what leaders can do to turn intent into impact.

🔍 In this episode:

Why compliance training doesn’t build culture
The data showing champion programs lack leadership and incentive alignment
How developers, AppSec teams, and business leaders each contribute to the gap
Insights from OWASP, ENISA, and Forrester on what’s missing

Sean’s Take:

When security culture is treated as a checkbox, nothing changes. When it’s connected to ownership, incentives, and everyday work — everything does.

Catch the full companion article in the Future of Cybersecurity newsletter for deeper analysis and more research.

For developers: Has your security-champion program helped ship safer code—or just added meetings?
For application security professionals: Are your metrics tied to risk reduction or participation counts?
For business leaders: Can you connect your “security culture” investment to measurable resilience?

📖 Read the full companion article in the Future of Cybersecurity newsletter for deeper insights: https://www.linkedin.com/pulse/building-real-security-culture-why-most-appsec-fall-martin-cissp-eab7e

🔔 Subscribe to stay updated on the full AppSec Contradictions video series and more perspectives on the future of cybersecurity: https://www.youtube.com/playlist?list=PLnYu0psdcllRWnImF5iRnO_10eLnPFWi_

________

This story represents the results of an interactive collaboration between Human Cognition and Artificial Intelligence.

Enjoy, think, share with others, and subscribe to "The Future of Cybersecurity" newsletter on LinkedIn: https://itspm.ag/future-of-cybersecurity

Sincerely, Sean Martin and TAPE9

________

Sean Martin is a life-long musician and the host of the Music Evolves Podcast; a career technologist, cybersecurity professional, and host of the Redefining CyberSecurity Podcast; and is also the co-host of both the Random and Unscripted Podcast and On Location Event Coverage Podcast. These shows are all part of ITSPmagazine—which he co-founded with his good friend Marco Ciappelli, to explore and discuss topics at The Intersection of Technology, Cybersecurity, and Society.™️

Want to connect with Sean and Marco On Location at an event or conference near you? See where they will be next: https://www.itspmagazine.com/on-location

To learn more about Sean, visit his personal website.

Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.

Brazil's January 6th