Individual skill, team readiness, organisational response: three levels of training

It helps to think of security training in levels. Each level answers a different question about readiness, and each training type is designed for one of them. Buying for the wrong level is the most common way to spend a training budget without changing how an incident goes.

What is the individual level?

The question here is simple: can this person do this task? Can the analyst investigate a suspicious login, read a packet capture or write a detection rule? Hands-on labs answer it. They are short, repeatable and measurable per person, and large libraries mean every role can have a path. Awareness training also works at the individual level, but for every employee and for everyday behaviour rather than technical work.

What is the team level?

The question becomes: can these people work an attack together? A team of skilled individuals can still lose hours to unclear handovers, duplicated work or a shift change in the middle of an incident. A cyber range answers this question by putting the team under a live attack with shared tools. Cyberbit, for example, lists 100+ team exercises next to 2,800+ solo labs on its platform, which is a fair picture of how the two levels relate: many individual tasks, fewer but larger team exercises.

What is the organisational level?

Here the question is: can the organisation make the right decisions in time? This involves people who never touch a console: executives, legal, communications, HR, sometimes the board. Tabletop and crisis simulation answers it. NIST's guide to test, training and exercise programmes, SP 800-84 (September 2006), already separated training people from exercising a plan; the same distinction holds today. CISA's free tabletop packages, over 100 of them, are written for this level, with discussion questions and an after-action report template.

Some platforms reach across levels in one exercise. Cyberbit's Crisis Sim 360 links technical escalations to executive decisions, and iluminr runs from individual microsimulations to team exercises for crisis teams.

Why does skipping a level hurt?

Because the levels depend on each other but do not substitute for each other. Excellent analysts do not fix a slow executive decision about disclosure. A confident executive team does not fix a detection that never fired. And a successful phishing campaign shows a front-door gap that neither labs nor tabletops address.

A practical rule: check your last incident against each level in turn, and note which level the worst delay sat at. That is where the next training money should go.

How should a programme mix the levels?

A typical programme runs individual training continuously, team exercises a few times a year, and organisational exercises at least once a year, with fixes from each feeding the others. The proportions depend on your gaps, not on a standard ratio.

What next?

The next lesson moves to buying: how to size a hands-on lab programme for a SOC, and what the published prices tell you.