Change marketing for internal teams
A security or risk program only works if people inside the company change what they do. That is a marketing problem aimed inward: a named audience, evidence, a message they can act on, and a reward system that does not contradict the ask.
What is change marketing?
Marketing discipline applied to an internal audience in order to change behavior: naming the group whose actions determine the outcome, earning visible sponsorship, and correcting the reward system that contradicts the ask.
Most of what a security, risk, or resilience leader needs is a change in behavior inside their own company: engineers choosing a different tool, managers making room for a review, an executive team funding something that produces no revenue. That is a marketing problem, pointed inward, and it fails for the same reasons external marketing fails.
Who is the audience for change marketing?
Programs aimed at everyone reach no one. The question is which group's behavior actually determines the outcome, and what they would have to believe to act differently. Sometimes it is a few dozen engineers. Sometimes it is the twelve managers who set quarterly priorities. Treating the whole company as the audience is the internal version of choosing an audience by accident.
- Whose behavior has to change for the outcome to happen.
- What they believe today, and what makes the current way rational for them.
- What they lose by changing, stated honestly.
- Who has to visibly sponsor it for the change to be legitimate.
How much does executive sponsorship matter?
Executive support gets treated as a prerequisite when it has to be won. It is an audience decision with a single member, and it needs the same evidence: what the exposure is in the company's own numbers, what doing nothing costs, and what specifically changes. This is the same argument as explaining a security program to a board, one level down.
Why do change programs stall?
You get more of whatever you reward, and companies reward with four currencies: attention, budget, promotion, and the stories they retell. A program that asks people to slow down while the company still rewards shipping speed will lose, no matter how good the communication is. Before launching anything, audit what the current system actually pays for — efficiency without direction is the same failure in a different costume.
How do you sequence the message?
Different audiences need different things and at different moments: the practitioner needs to know what changes in their day, the manager needs to know what gets dropped to make room, the executive needs the risk in business terms. A single all-hands announcement serves none of them well. The same committee logic that governs demand generation applies here, with the added difficulty that your audience cannot opt out and will remember the last three programs.
What should you measure?
Where it fits
The method does not change when the audience is on your payroll.
What people ask
Why do security and risk programs stall after rollout?
Because the policy changed and the reward system did not. People keep doing what earns them attention, budget, and promotion. If the fastest path to a shipped feature still routes around the review you just introduced, the review loses — every time, regardless of the training completion rate.
Who is the audience for an internal program?
Rarely everyone. Usually one group whose behavior actually determines the outcome — the engineers who choose tools, the managers who set priorities, the executives who fund the change — plus the sponsor whose visible support makes it legitimate. Naming that group is the first decision, and most programs skip it.
How do you measure internal change?
By what people do, not what they attended. Adoption of the new path, decline in the workaround, time-to-approval, incidents caught earlier. Training completion and awareness scores measure compliance with the program, not change in the company.
Training completion, awareness scores, and portal visits measure compliance with the program. What matters is adoption of the new path, decline of the workaround, and whether decisions are being made differently. Reporting the second set is harder and occasionally embarrassing, which is exactly why it works. Related: marketing resilience internally.