Allow Some Deny All - Hacking, Coffee, Community

Disclaimer: The views and opinions expressed are my own and do not reflect the views, policies, or positions of my employer or any organization with which I am affiliated. --- In my last post, I argued that security awareness has become too clean. Too polished. Too predictable. Too focused on recognizing examples instead of developing judgment. Criticism is easy. The harder question is what we build instead. I don't think the answer is better graphics, and I don't think it's making every employee learn Linux or reverse malware. The problem isn't that security awareness isn't technical enough. It’s that we don’t give people enough opportunities to practice making decisions. I've been experimenting with a different model. It isn't one product or format, but a set of principles, mechanics, and techniques built around a premise: teach judgment. Not recognition of training, memorization of policy, or completion.  Judgment. --- Start With the Decision A lot of tra...

Disclaimer: The views and opinions expressed are my own and do not reflect the views, policies, or positions of my employer or any organization with which I am affiliated. ---  (Cyber)security awareness training (SAT) has long focused on recognizing threats inside the enterprise, but anyone who has dealt with a real compromise knows attacks rarely respect those boundaries. Real breaches are messy. They’re personal.  They involve bad timing, strange messages, compromised friends, personal accounts, social media, reused credentials, AI-generated likenesses, family members, phone calls, desperation, embarrassment, deception, and sometimes outright threats or blackmail. Yet we teach security awareness with polished graphics, spotless templates, friendly AI-generated illustrations, and scenarios where the suspicious answer is practically given. What are we actually teaching people to recognize? The problem is that training today focuses too heavily on... Recognizing sp...

Cybersecurity’s long attracted those seeking a challenging and financially lucrative career, but if you’ve ever tried to break into the field, you’ll know it’s far from straightforward. Whether you’re already in IT or coming from a completely different profession, figuring out how to pivot can be overwhelming. Check out r/SecurityCareerAdvice , and you’ll find plenty of questions like, “How do I move from help desk to SOC analyst?” or “What’s the best path from System Administrator to Security Engineer?” or even “How do I jump from Human Resources to Cybersecurity?” The interest is there, but the roadmap? Not so much! The problem is that cybersecurity career training today focuses on…      1.   Those already in Information Technology           2.   Teaching specialized Skills These topics are valuable for certain roles, but they’re not really designed to help someone transition into the industry. How can we improve trainin...