Start from the last incident: matching training to the gap it exposed

Most training purchases start with a demo. A vendor shows a polished range or an impressive simulation, and the team buys the format it has just seen. A better starting point is your own record: the last real incident, the last near miss, or the last exercise or audit finding. Each of those tells you where people struggled, and the place they struggled tells you which kind of training fixes it.

What kinds of gap are there?

Gaps fall into three families, and each points to different training.

• Technical gaps: an alert was missed, triage took too long, an analyst did not know how to investigate a cloud workload, a detection never fired. These are skill and tooling problems. They call for hands-on labs for individuals and a cyber range for the team.
• Decision gaps: nobody knew who could approve isolating a system, legal heard about the incident a day late, the message to customers went out before the facts were checked, or the executive team argued about authority mid-incident. These are decision and coordination problems. They call for tabletop and crisis simulation.
• Front-door gaps: an employee clicked a phishing link or did not report a suspicious call. These are behaviour problems across the workforce. They call for awareness training.

How do you read your own record?

Take the timeline of the last incident or exercise and mark every delay longer than you would accept. For each delay, ask one question: was the problem that someone did not know how to do something, or that someone did not know whether they were allowed to, or who should? The first is technical. The second is a decision gap.

The data says detection itself is moving. Mandiant's M-Trends 2026 reports a global median dwell time of 14 days, up from 11 the year before, and says 52% of intrusions were first detected internally in 2025, against 43% in 2024. If your own detection numbers look worse than you would like, the technical lanes deserve attention. If the timeline shows quick detection followed by a slow, uncertain response, the decision lane does.

What if you find several gaps?

Most teams do. Order them by the damage each delay caused or could have caused, and fund the first one properly before spreading budget across all four types. A platform that sells several types can help later, but buying breadth before you know your first gap tends to leave some modules unused.

NIST SP 800-61 Revision 3, the incident response guidance published in April 2025, frames incident response as part of overall cybersecurity risk management rather than a separate activity. That is a useful lens for training too: the aim is a faster, better-governed response, not a training catalogue.

What next?

Answer the five questions in the training type finder with your first gap in mind. The next lesson explains the three levels at which training works: the individual, the team and the organisation.