Solo Campaign: Building Security Culture When You’re the Whole Department

You ARE the IT department. You are also the security team, the awareness program, and the culture change initiative. You have no budget, no dedicated staff, and a workforce that clicks through compliance training and forgets everything by Friday. Nobody is coming to save you. But you already knew that. Good thing you like a challenge. Clicking through an annual module isn't culture. Culture is what your staff does when nobody is watching. And this talk is about building exactly that. At an alternative education nonprofit, I designed and ran a 12-week voluntary champion program using quest-based learning and fantasy-themed red team trials to reframe security from a compliance burden into something staff actually want to engage with. Here's the ground-level account: the wins, the wipes, and what I'd roll differently on a second playthrough. You'll leave knowing how to scout champions by behavioral traits rather than technical skills, because the best security advocates in your building probably don't have "security" in their job title. You'll know how to run red team trials that teach rather than punish, with debrief structures that turn getting caught into a learning moment. You'll know how to build toward a tabletop exercise your staff is actually ready for, because champions deserve a victory lap before the boss battle. And you'll know how to design participation pathways that work across communication styles and neurotypes, because a security culture that only works for one kind of person isn't a security culture at all. You'll walk away with the complete toolkit, ready to adapt for your own organization. The security team you need is already in your building. Find them, train them, and more importantly, trust them.