Cybersecurity Training Needs More Room for Failure

A cybersecurity exercise where everything goes according to plan is wonderfully reassuring. It may also be slightly suspicious.

Real incidents rarely arrive with tidy instructions. An alert can look harmless until it isn’t. Evidence can contradict itself. Someone makes an assumption, spends 20 minutes following it and discovers they were looking in entirely the wrong place.

That messy part of cybersecurity deserves a bigger role in how people are trained.

NIST’s National Initiative for Cybersecurity Education (NICE) is putting that idea directly into its workforce discussion. Its upcoming September session on preparing students for cyber careers focuses on realism-based training, including how controlled failure can become useful workforce data rather than something educators simply mark wrong.

That’s a useful distinction. A score tells you whether someone found the answer. Watching how they reached it tells you much more.

A Wrong Answer Can Reveal the Real Skills Gap

Imagine two SOC trainees investigating the same suspicious activity. Both eventually identify the threat. One gets there systematically. The other clicks through five theories, misses a clue and reaches the answer mostly by luck.

On paper, both passed. Operationally, they’re in very different places.

Realistic exercises can reveal things that conventional tests struggle to measure:

• Whether someone knows what evidence to prioritise
• How they respond when their first assumption is wrong
• Whether they can explain a technical decision clearly
• How effectively they work with other people under pressure
• When they escalate a problem instead of trying to solve everything alone

These are difficult skills to learn from a slide deck. PowerPoint, despite many years of dedicated service, still can’t simulate a production incident.

Indonesia Is Moving Toward Work-Based Learning

Indonesia’s broader workforce policy is also putting more emphasis on training that connects directly with work.

On 1 September, Coordinating Minister for Economic Affairs Airlangga Hartarto launched the latest National Vocational Training program and stressed the need for competencies that match changing industry requirements.

Some vocational programs are already extending that approach beyond classroom instruction. BBPVP Bandung’s September intake, for example, includes a one-month project-based on-the-job training period after formal training.

Cybersecurity needs the same connection between learning and doing, perhaps even more urgently. A real organization isn’t a good place to discover that someone has never handled an ambiguous incident before.

Practice Should Be Allowed to Get Messy

Cyber ranges and realistic simulations create a useful middle ground. People can investigate, make decisions, get something wrong and understand why, without an actual customer database having a particularly bad afternoon.

For training teams, those mistakes are valuable. They show where knowledge stops and operational judgment begins.

That principle is part of the learning approach at ITSEC Cyber & AI Academy, where practical exercises and realistic scenarios give participants opportunities to apply cybersecurity knowledge rather than simply remember it.

The goal isn’t to create exercises everyone can finish perfectly. It’s to create professionals who’ve already encountered confusion, wrong assumptions and difficult decisions before the stakes become real.

Explore practical cybersecurity and AI training at ITSEC Cyber & AI Academy.

References: NIST NICE: Preparing Today’s Students for Tomorrow’s Cyber Careers · Indonesia’s Coordinating Ministry for Economic Affairs: National Vocational Training, 1 September 2026 · BBPVP Bandung: project-based vocational training, September 2026