A security professional can be compared to a professional athlete. Both must have the appropriate skills to consistently and safely perform their duties. Most importantly, both must perform BETTER THAN THE OPPONENT. In security, lives are at stake. The difference shows in how each spends their time. An athlete trains 80% of the time and competes for 20%. A security professional does the exact opposite. This is why security training must be built for that reality.
What is an expert?
How can you tell if someone is an expert? Real expertise must pass three tests:
Performance must be consciously superior to that of other people in similar circumstances.
Real experience produces concrete results.
Expertise must be measurable and replicable in a controlled environment.
In the words of British scientist Lord Kelvin: "If you cannot measure it, you cannot improve it."
Malcolm Gladwell's principle
In his book "Outliers," Gladwell argues that any expert must have dedicated an average of 10,000 hours to practicing their craft. He cites examples such as Bill Gates and Ludwig Von Beethoven. However, his concept is only partially correct. It is true that any expert requires dedication. But incorrect practice will result in inadequate skills. 10,000 hours invested in the wrong skill will make you very good at the wrong thing. That will never lead to expertise. Suppose you must gather 10,000 hours of practice to become a security expert. Will you spend that time learning how to jump out of helicopters and throw knives at long distances? Let's be realistic. If you have limited time, you must choose the appropriate training for your function. Then consistently practice the skills that will help you in your daily work. This is the core logic behind effective security training.
Deliberate practice
Humans tend to take the easiest or the path of least resistance; we like to practice what we already know how to do, which is more fun and requires less effort. Deliberate practice requires working at the limit of your abilities, which involves frustration, effort, and time. Therefore, a pleasant experience does not necessarily mean good training. Beware of false empowerment of training programs that claim to teach "special forces" techniques to security teams. Special forces from any country have demonstrated superior expertise and performance compared to their counterparts, and they have invested more than 10,000 hours to achieve it. Doesn't it seem illogical that they would teach you the same thing in a few days?
Hard Skills vs Soft Skills
There are two types of skills that you must work on: hard skills are actions that require consistent execution. In other words, they are skills with only one correct path and must be done the same way every time (e.g., a golf swing, a J-turn, or drawing a pistol). On the other hand, soft skills have many paths to be carried out and do not require a perfect movement but rather the agility to adapt to make the best movement. These are skills adaptable to each situation (e.g., a boxer applying a combination when the opponent drops his guard or a driver reacting to a change in the road). Practicing soft skills as if they were hard skills, with strict scenarios, is the most dangerous way to create a false skill, as it eliminates the person's adaptability and limits them only to what they have practiced.
Knowledge vs. Skill
A skill cannot be achieved through studying. When you study, you create knowledge. A skill requires a neural connection called a synapse. When we practice something, our brain sends electrical impulses. These impulses create that connection that automatically performs the movement or skill. With practice, the connection becomes much stronger through myelination. It also becomes faster and more consistent. A study conducted by the U.S. Army Research Institute for the Behavioral and Social Sciences demonstrated a clear pattern. Most skills obtained by students are lost during the three weeks following training. They continue to decrease gradually until they disappear in approximately 12 months. Soldiers require different degrees and amounts of training to achieve specific performance levels. However, once that level is reached, performance declines in the same proportion for all participants.
Things to consider when evaluating a program.
Individual cases of experience are usually ineffective.
First, people's memories are inaccurate. The human brain tends to modify our memories over time. Second, one person's experience may be very good. But it is constrained. It is just one experience among millions of possibilities. That is why associations exist. They group thousands of people with thousands of experiences. From this, they develop standards. Those standards ultimately set the pace for what an expert should know and train for.
Many people mistakenly believe that they have experience. Remember that authentic experience is demonstrated by measurable and consistently superior performance. Some supposed experts are only superior when explaining why they made mistakes. The amount of training and experience they claim does not matter. An expert can only meet the first points of this section under one condition. They must base their teaching on standards that guarantee results.
Intuition can lead you down the wrong path.
The idea that you can improve your performance by just "trusting your instinct" is common. Intuition may be valuable in routine or familiar situations. But informed intuition is the result of deliberate practice. You must consistently improve your ability to make decisions, or your intuition. This requires considerable practice, reflection, and analysis.
You don't need a better tool.
Many managers expect their people to suddenly improve their performance by adopting new and better methods. This is like a golfer who believes they will improve their game with a new club. Changing to a different club can increase grip variability. It can make playing well more challenging. In reality, the key to improving expertise is consistency and carefully controlled efforts.
In conclusion, living in a cave will not make you a geologist. Not all practice makes perfect. Only appropriate practice makes perfect. It generates measurable results that are consistent. Above all, those results are replicable in different real-world situations. Good security training, appropriate practices, and sufficient dedication are the best tools for any security professional, or any other environment.
We don't rise to the level of our expectations; we fall to the level of our training. -- Archilochus