Training Completion Is Not Cybersecurity Competence

I tend to distrust a neat answer when the actual system is messy. A completed course tells me that somebody sat through it. It does not tell me that person can recognize a fraudulent payment request or make a sensible call during an incident. The useful question is what somebody can demonstrate when the decision matters, not how persuasive the presentation was when everything was quiet.

The wrong measure

A completed course tells me that somebody sat through it. It does not tell me that person can recognize a fraudulent payment request or make a sensible call during an incident. (Merritt et al., 2024). I want to know who owns the control, how it behaves when the normal process fails, and what evidence would change the decision. The answer has to come from the actual system rather than a slide describing the intended architecture.

Teach the decision

A finance employee, software developer, and executive have different authority and therefore different ways to make consequential mistakes. (National Institute of Standards and Technology, 2024). There is a difference between a policy and a capability. I would ask the team to demonstrate the important boundary, explain the exception path, and identify the person who can authorize the consequential action.

Practice uncertainty

Real work rarely arrives as a multiple-choice question. It arrives with partial evidence, a deadline, and somebody insisting the decision cannot wait. (Nelson et al., 2025). I want to know who owns the control, how it behaves when the normal process fails, and what evidence would change the decision. The answer has to come from the actual system rather than a slide describing the intended architecture.

Measure behavior

I would measure whether people escalate correctly, follow approval paths, and recognize when they lack enough evidence, not whether they liked the presentation. (Joint Task Force Transformation Initiative, 2012). There is a difference between a policy and a capability. I would ask the team to demonstrate the important boundary, explain the exception path, and identify the person who can authorize the consequential action.

Let incidents change the curriculum

If a breach reveals a recurring decision failure and next year’s training remains unchanged, the organization has turned education into ceremony. (Joint Task Force, 2018). I want to know who owns the control, how it behaves when the normal process fails, and what evidence would change the decision. The answer has to come from the actual system rather than a slide describing the intended architecture.

The decision I would make first

A strong curriculum begins with an operational task analysis. Ask what the employee can authorize, what evidence is available, how the mistake would present itself, and which escalation path is expected. Then create practice that resembles that situation rather than a generic threat slideshow.

For leaders, an exercise should include conflicting priorities and uncertain evidence. For engineers, it might involve a flawed deployment decision. For finance, a suspicious payment change. Success is a changed behavior that survives the classroom, not a score that looks good in a learning system.

I design cybersecurity learning programs and executive exercises around real decisions, not completion certificates.