How would you master any skill? By practice and training. Cyber security is no different. Nobody is born a cyber security expert; everyone needs to gain the relevant skills and work diligently to keep them up to date and build upon them. However, practising what you learn in cyber security has certain requirements. Example: it usually involves setting up a computer lab environment to ensure the setup won’t harm production systems. This is why training platforms are indispensable in your journey to becoming a “master.”

You might have heard the saying, “An ounce of prevention is worth a pound of cure,” and cyber security is no different. When responsible for system security, it is better to learn in a training environment than during a live incident. Moreover, proper training increases the quality of the cyber security team’s work and, therefore, reduces the likelihood of incidents.

The real power of training from an organisation’s perspective is that it increases the team’s capacity without hiring additional team members. The main reason is that it prepares the team to handle what will come their way. Instead of learning new concepts, techniques, and tools in the middle of a cyber attack, they have come prepared.

Training makes it feasible to hire junior people and give them the means to ramp up quickly. Training also decreases the effort required by senior staff to train the same material over and over again.

Centralised training creates a common baseline within an organisation to assess skills, knowledge, and their development. Instead of vague terms like “junior” or “senior,” employees’ skills can be described more specifically. This makes it easier to make informed decisions when assigning tasks to an employee or a team. Insights into an employee’s current skills also clarify the path they must follow to take the next step.

Finally, training can be fun and can foster teamwork. For instance, the experience of being part of a team playing a CTF (Capture the Flag) challenge builds incredible friendships, which will help when needed.

For smaller teams, off-the-shelf training would be the most logical choice. However, if your team exceeds a certain size, typically beyond twenty employees, or if your training needs are very specific, it makes sense to customise existing training to your organisation’s needs. TryHackMe enables this via “Content Studio.” This feature allows you to modify or even create modules based on your organisation’s training needs and priorities. Such customisation increases the efficacy of your users’ training.

Large corporations don’t want a standalone solution but need it integrated into their existing software landscape. They usually look for a training solution that supports SSO (Single Sign-On) and has well-documented APIs. Such functionalities ensure training with existing systems seamlessly.

Companies invest in their employees as any intelligent, wealthy person invests in their assets. Although you expect your company to realise the importance of training and encourage or even require employees to undergo specific training routes, sometimes you must make a case to convince them. Let’s consider a scenario to study the value of training.

Calculating the Financial Impact of Training

Let’s talk numbers! To calculate the financial impact of training, we will consider the following case:

• Situation: A cyber security team has ten employees
• Cost: Each employee costs $80,000 annually
• Assumption: Training increases productivity by 4%

Knowing that one employee costs $80,000 annually and that we have ten employees, then the savings (gains) due to the training of ten employees are $32,000 (10 × 4% × $80,000).

Assuming that the cost of training is $500 per employee, the total cost is $5,000 (10 × $500 = $5,000).

It is easy now to show that the Return On Investment (ROI) is 640% ($32,000/$5,000 = 640%).

Writing a Training Proposal

At TryHackMe, we’ve seen many proposals and learned what works and what doesn’t. Consider downloading the attached proposal, Cost savings by investing in Cyber Security training. It should increase the likelihood of obtaining the budget.

Now that we have learned the importance of training, we need to consider the selection of the training vendor. There are a few essential questions to consider, which can aid in vendor selection. We list the following questions that those responsible for vendor selection should ask:

• Who are you buying the training for?
• What are the experience, background, role, and topics relevant to your employees?
• Has the vendor experience with similar organisations?
• What is the content’s breadth, depth, and quality for the topics you care about?
• Can users learn, train, and practice on a single platform?
• The cost of training is important for the CFO (Chief Financial Officer); however, given the cost of cyber security employees, the cost of training is typically dwarfed by the benefits of making the team more productive.

Thinking about and answering these questions is a critical step for making the optimal vendor selection that suits the needs of your company and your team.

This room discussed the importance of training at the company level. Training is an indispensable ingredient for a cyber security team’s performance. Many people, especially knowledge workers, believe in lifelong learning, and many companies encourage and require their employees to undergo regular training. This policy proves rewarding both for the trainees and their employers.

Please check out business.tryhackme.com if you’d like to know more about how TryHackMe can accelerate learning at your organisation. Check out TryHackMe Classrooms if you’d like to learn more about what TryHackMe can do for Educational institutions (schools, colleges, universities, etc.)