An application security team of 3-5 engineers trying to scale secure development practices across 50+ software engineering squads needs to design a Security Champion Programme — identifying champion selection criteria, defining a structured training curriculum, creating engagement mechanisms, and measuring programme effectiveness — without burning out the core AppSec team.