"Not harsh, not scary": Establishing a cyber champions program at an Australian university

In late 2024, the University of Melbourne launched a Cyber Champions Program to address longstanding cybersecurity culture challenges in a large, complex organisation. In just two years, the program has grown into a thriving network of more than 150 staff from across the University, with evaluation data showing a measurable uplift in cybersecurity awareness and secure behaviours directly attributable to the influence of our champions.

What makes this program successful, and why does it stand apart from other communities of practice or champion networks? Early evaluation revealed a consistent theme: participants were surprised by the program’s supportive, inclusive and non judgemental tone. Monthly workshops bring technical experts and champions together in a safe space to explore complex topics, ask questions freely, and gain practical knowledge they can take back to their teams.

This approach is particularly significant given champions’ motivations for volunteering. Many participants reported having been personally impacted by cyber incidents in their own lives. Creating an environment that avoids blame, fear or patronising language has been essential to building confidence, trust and sustained engagement.

Cybersecurity professionals are often conditioned to communicate risk through urgency and hard lines. At the University of Melbourne, we have deliberately taken a different path. The Cyber Champions Program uses storytelling, interactive activities and informal, jargon free language to foster inclusion and shared responsibility. In feedback surveys, champions consistently describe the sessions as fun, approachable and engaging — with one champion capturing the program’s ethos in four simple words: "Not harsh, not scary."

In this session, Emily will explore one of the most overlooked ingredients of a successful Cyber Champions Program: humanity. Whether you are establishing a new champions network or looking to revitalise an existing one, this session offers practical insights for creating cybersecurity engagement that people genuinely want to be part of.