The lab is where visibility starts to break down.

If you run cohort-based cybersecurity training, you already know the difference between a lecture and a lab. Both require a lot from the instructor, and neither guarantees that everyone is following. But they create very different visibility challenges.

In a lecture, the group is generally working through the same material at roughly the same time. You can listen to questions, read reactions, notice where people seem confused, and adjust what you're doing based on what you see and hear.

A lab is different. The moment students start working with their hands, they scatter. One is three exercises ahead and bored. Another is still stuck on setup and hasn't run a single command. A third has a working answer built on a method that will fall apart next week, but right now their screen says green.

This is the part I want to name plainly, because I think it gets misdiagnosed. The problem isn't effort. A good instructor in that room is working hard. The problem is that parallel work outruns serial attention. Twenty or fifty people are all doing different things at the same time, and one person can only witness one thing at a time.

Being present is not the same as seeing

An instructor can be fully present in a lab and still only catch a thin slice of what's actually happening across the room.

Walk over to help the student who raised their hand, and for those few minutes you're blind to the other forty screens. Someone quietly gives up in the corner. Someone else brute-forces a task in a way that gets the right output and teaches them nothing. You'll never see either, because you were busy being useful somewhere else.

This scales badly, and the numbers make it obvious. Across the programmes I've been part of, instructor-to-student ratios ran anywhere from about 1:4 up to 1:14 or 1:15, in cohorts of 12, 24, and 55. At 1:4 you can keep up. At 1:15 in a room of 55, you are not observing a lab. You are triaging one.

Mixed-skill cohorts make the gap wider

Now add the range of people you're actually teaching. Some cohorts I worked with had rigorous, aptitude-based admission. Others were beginner courses for people with no technical background at all, moving into cybersecurity from somewhere else entirely. Same lab, same clock, wildly different starting points.

A single pace can only ever fit one part of that group. Set it for the strongest students and the beginners drown quietly. Set it for the beginners and the strongest ones coast, disengage, and leave with less than they could have. Most of the time you're splitting the difference and serving neither well. The scatter isn't a discipline problem. It's the honest result of one pace meeting many levels.

The LMS shows you the finish, not the run

Here's where it gets worse. The one tool that's supposed to give you visibility mostly shows you the wrong thing.

An LMS records submissions. It tells you a task was completed, a status went green, a completion rate ticked up. What it doesn't show you is the run: how the student got there, where they stalled, what they tried, whether they understood the exercise or pattern-matched their way past it.

A correct submission built on a flawed process is a future problem wearing a good grade. Completion rates measure that something arrived. They don't measure whether the skill actually transferred. So you end up with a dashboard that looks healthy and a room where the most important things are invisible to the person running it.

This is a design question, not a staffing one

The instinct is to treat all of this as a capacity problem. Hire more instructors, shrink the ratio, add TAs. That helps, but it also caps your growth on the availability of scarce, expensive, skilled people, and it puts your best instructors on repetitive work that doesn't need their skill.

I'd argue it's really a design question. We built a model where visibility into a lab depends entirely on one human being able to watch everything at once. That was never realistic, even at small ratios. Parallel work has always outrun serial attention. We just accepted the blind spot because there wasn't another option.

The honest question

When your students scatter across a lab and you can only stand in one place, what are you not seeing? And how much of your programme's real quality lives in that blind spot?