Solo Campaign: Building Security Culture When You're the Whole Department

You ARE the IT department. You are also the security team, the awareness program, and the culture change initiative. You have no budget, no dedicated staff, and a workforce that clicks through compliance training and forgets everything by Friday.

Nobody is coming to save you. But you already knew that. Good thing you like a challenge.

Clicking through an annual module isn’t culture. Culture is what your staff does when nobody is watching. And this talk is about building exactly that.

The Campaign

At an alternative education nonprofit, I designed and ran a 12-week voluntary champion program using quest-based learning and fantasy-themed red team trials to reframe security from a compliance burden into something staff actually want to engage with.

Here’s the ground-level account: the wins, the wipes, and what I’d roll differently on a second playthrough.

What You’ll Leave With

Scout champions by behavioral traits, not technical skills

The best security advocates in your building probably don’t have “security” in their job title. Learn what to actually look for.

Run red team trials that teach rather than punish

Including debrief structures that turn getting caught into a learning moment instead of a disciplinary one.

Build toward a tabletop exercise your staff is actually ready for

Champions deserve a victory lap before the boss battle.

Design participation pathways that work across communication styles and neurotypes

A security culture that only works for one kind of person isn’t a security culture at all.

You’ll walk away with the complete toolkit, ready to adapt for your own organization.

Why This Matters

The security team you need is already in your building. Find them, train them, and — more importantly — trust them.