Beyond the Basics: Rethinking and Refreshing Security Training in the Age of Ever-Evolving Threats

A mate of mine recently joked that there was no point in “refreshing” security training every year. “The fundamentals don’t ever change,” he griped. “A virus is still virus, links are always bad, and spam is forever. What’s the point? Just teach it once and be done with it. Listening to the same lecture over and over and over again is annoying, boring, and useless.” 

To be fair, my pal was trying to get a rise out of me. Still, he wasn’t entirely wrong. Teaching the same dry facts in the same dry order every year in ineffective. Users get bored. God knows I get bored when I’m forced to endure the exact same g course for the second, third, or fiftieth time. I quickly become mentally and emotionally disengaged even when I believe in the course’s message. That’s one of the reasons why I advocate changing how security fundamentals are taught on a regular basis. People are more likely to listen to a story they know when it’s told in an interesting new way. 

Training is only 10% recitation of facts and 90% storytelling. People learn our material best when we engage their imagination. Entertainment can help mitigate monotony. Novelty is a draw in its own right. That being said, there’s more to refreshing a course than just variety for its own sake. “Freshening” can often be accomplished by updating the examples used to more recent events. If we talked about a 2022 incident in our 2023 course, then users can and should expect to hear about a new 2023 incident in their 2024 course. 

Additionally, exploring existing topics from new perspectives help ignite learners’ interest. When ransomware was new, for example, its novelty alone made it interesting. Rather than “re-train” students on the concept of ransomware the year after, it would be more engaging to learn about a new attack type, new lure, or new exploitation measure. 

Finally, the way we tell our stories naturally changes from year to year to reflect the times we live in and the worldviews we share. As times change, our stories will evolve … whether we intended them to or not. Knowing that, I propose that it’s advantageous to regularly re-design our courses from square one to deliver a more contemporary – and, therefore, more resonant – take on our subject(s).