Build a Training Plan Around Your Next Security Project

New technology brings new security challenges. But when organizations roll out AI tools, migrate to the cloud, or introduce new applications, they don’t always account for the skills their security teams will need to protect them.

Security training shouldn’t be an afterthought. By aligning hands-on learning with upcoming projects, organizations can prepare their teams for new responsibilities before those skills become critical.

That challenge becomes clear when the project changes someone’s responsibilities. An application tester may now need to assess a cloud-hosted service, while an incident responder inherits an environment they’ve never investigated. General experience matters, but new technologies require new skills before practitioners can confidently take on these responsibilities.

Building skill development into the project gives people time to prepare while decisions are still being made. It also gives managers a more useful basis for choosing training: the work their team will actually perform.

The key is establishing an approach that can support a cloud migration, the integration of an acquired business, or an AI rollout. That starts by connecting the changes an organization is making with the skills its security practitioners need to support them. 

Consider a team preparing to move a customer-facing application to a new cloud environment. Asking everyone to complete “cloud security training” leaves several questions unanswered. The people testing the application have different responsibilities from those who will investigate an incident after launch. Some already understand the infrastructure; others need that context before the more specialized material will be useful.

To build a training plan around the project:

1. Identify responsibilities and skill gaps. Start with the project plan. Discuss the work with the people who will own it and identify where their responsibilities extend beyond their current experience.
2. Match training to the work ahead. For the application assessment team, the immediate need might be understanding how the deployment changes what they must examine. Select training that supports that assessment, with time for hands-on practice before the review begins.
3. Define outcomes and protect learning time. Agree on an expected output, such as a documented assessment of a relevant lab environment. This gives learners and managers something concrete to work toward. It also helps managers justify dedicated learning time ahead of project milestones and shows employees how their preparation connects to upcoming responsibilities.
4. Align development with workforce frameworks. Where workforce frameworks guide role development, use them to help define expectations. OffSec aligns its training with NICE 2.1, CyROW, SCyWF, and DCWF, connecting learning with recognized roles and skills. Use the applicable mappings to support both the project assignment and the employee’s broader development plan.

Managers should be able to concentrate on their team’s needs without becoming curriculum designers. OffSec’s curated Learning Paths provide organized learning content around defined skill areas, so an organization can begin with an established path and review how well it fits the project.

For the migration team, the path objectives help distinguish foundational cloud learning from material focused on assessing cloud environments. That distinction matters when assigning work to people with different experience. It gives the manager a basis for selecting useful preparation without making every employee work through the same material.

OffSec’s Learning Path catalogue covers a range of needs that transformation projects can create:

The path’s objectives and included material should guide the selection. A complete path may already address the development need. 

An existing Learning Path may cover most of a project’s training needs, but leave gaps around specific skills or responsibilities. 

Use Custom Learning Paths to bring together the content your team needs and turn it into a clear training assignment.

1. Define what employees need to complete and why. Connect each assignment to the work employees will do on the project. With OffSec’s Custom Learning Paths, Learn Enterprise administrators can combine course modules, Learning Paths, and labs into a single assignment. Give employees a clear scope so they know where to focus and managers can track progress against the same requirements.
   
2. Sequence the content around employees’ starting skills. Put foundational training before practical exercises for employees who are new to a technology. Let experienced practitioners begin with more advanced material. Arrange the content in the order that best supports their preparation, building on what they already know.
   
3. Check the workload and set a realistic deadline. Before publishing, compare the estimated duration with the time employees can actually spend learning. Set the completion date early enough to leave room for practice and follow-up before the project review.
   
4. Create separate assignments where responsibilities differ. The team investigating incidents after the migration will need preparation that reflects its work. Reuse relevant context, then choose practical exercises for those responsibilities. Custom Learning Paths let you tailor those assignments while keeping training organized within the same platform.

Reading about a technique gives a learner a starting point. Applying it in a lab challenges them to make decisions, solve problems, and work through the consequences. For managers, that practice provides valuable insight into where employees may need additional support before applying those skills to a real project.

Build relevant labs into training assignments and review the results. For example, a team preparing for a cloud migration might practice investigating vulnerabilities in a lab environment and document their findings. Managers can review how they reached the conclusion, where they struggled, and whether additional learning or guidance would help.

OffSec’s labs give teams a place to develop those skills without practicing in production environments. New labs arrive weekly, including exercises based on recent vulnerabilities and offensive and defensive scenarios. Organizations can use those additions to keep practice relevant as technologies and threats develop.

Adjust training as project requirements change. If a cloud migration expands to include new technologies outside the original scope, revisit the assignment to ensure employees are developing the right skills. Custom Learning Paths allow administrators to add, remove, or reorder content as needed.

Keeping the assignment current requires judgment about workload as well as relevance. Replace material where appropriate, and give employees time to complete any additional practice. The benefit of an editable path is being able to respond to a real change in the work.

Once training is underway, managers need to monitor progress and address challenges before project milestones arrive. Waiting until the deadline to ask how training went leaves little opportunity to address difficulties.

OffSec’s Custom Learning Path reporting helps administrators track participation and progress, identify learners who haven’t started or have stalled, and review individual performance across modules, labs, and assessment attempts.

Use these insights to identify and address obstacles early. If an employee isn’t making progress, review their training activity together to determine whether they need additional guidance, more practice, or dedicated learning time.

As the application assessment approaches, evaluate training progress alongside hands-on performance. Completing an assignment is one measure of preparation, but reviewing employees’ findings and problem-solving approaches helps managers determine whether they need additional support before taking on project responsibilities.

Tracking progress also helps demonstrate the value of training to leadership. Managers can connect completed assignments to specific project responsibilities, show how teams are preparing for upcoming work, and reuse or adapt successful Learning Paths for future projects.

When training follows the organization’s project plans, development has a clear purpose and a point at which people will use it. Employees gain preparation for an approaching responsibility, and managers have a way to support them before delivery depends on their skills.

As the organization grows, those assignments become a useful record of how teams prepared for new work. They can be refined for later rollouts, supported with more training, and adjusted as responsibilities expand.

Explore Learn Enterprise to see how OffSec can help your organization prepare its teams for the projects ahead.