The Missing Security Program: A Framework for Customer Security Evangelism

Every SaaS platform invests heavily in securing its own infrastructure. Almost none invest in building the security capabilities of the people using it. That gap is where incidents live, and where this session starts. Customer Security Evangelism is the structured practice of building security awareness, changing behaviours, and increasing capability within your customer base. It's widely practiced. It's nowhere formalized. No job description. No methodology. No measurement standard. This session changes that. Drawing on a working program at Guidewire Software, a major insurance technology platform serving hundreds of enterprise clients, attendees will learn how to segment customers by security maturity and design communication that meets them where they are, not where you wish they were. You'll learn how to build a security narrative hierarchy: one version for the board, one for the security team, one for the end user, mapped to frameworks your customers already use. And you'll learn how to define behaviour change metrics that connect evangelism activity to measurable outcomes, the kind that protect program budgets when someone asks what you actually accomplished. This isn't a product pitch. It's a blueprint drawn from behavioural science and social change communication, applied to the hardest problem in platform security: the people on the other side of your shared responsibility line. You'll leave with a segmentation model, a narrative hierarchy, and a measurement approach you can start building on Monday. Attendees will be able to: Segment their customer base by security maturity and design programs that meet customers where they are Build a three-level security narrative hierarchy mapped to frameworks that their customers already use Define behaviour change metrics that connect evangelism activity to outcomes that leadership can fund