A Cohort Can Look Healthy While Three Students Are Already Lost
A healthy-looking cohort and a healthy cohort are not the same thing. The dashboard measures the average, and the average is exactly where the people in trouble hide.
Field notes from real cohorts
What good cybersecurity training actually looks like - and what gets in the way. Written by practitioners who've run the sessions
A healthy-looking cohort and a healthy cohort are not the same thing. The dashboard measures the average, and the average is exactly where the people in trouble hide.
A physical training room quietly supplies a safety net no LMS was ever built to provide. Moving a cohort online doesn't just remove that net - the dashboard just stops telling you it's gone.
Most certification prep programmes borrowed their delivery structure from the classroom. Some of what they carried over deserves a harder look — because the context is different, the stakes are different, and the students are different.
When you're running a training session in a physical classroom, the real signal isn't in the lecture room — it's in the exercise room. And that one only works because you're physically in it.
The lab is where visibility starts to break down. Parallel work outruns serial attention, and one instructor can only witness one thing at a time.
If you run a hands-on cybersecurity training programme, you already know where growth stops. It stops at the support model.
There are specific moments in a learning session where an intervention actually lands. Most platforms are structured to miss all of them.
Every cohort is a range. Almost every training programme responds the same way: pick a pace, accept it won't work for everyone, and move on. There's a better structural question to ask.
Get notified when we publish new articles on training design, learning science, and what we're building