Panel: Evolution Of Learning: What Cyber Security Training Looks Like In 2023

Panel: Evolution Of Learning: What Cyber Security Training Looks Like In 2023

Speakers: Matteo Beccaro (Opposing Force), Khalifa Shamsi (CEO, Cyber Defense & Pen Testing Co.), Tim (CEO, Reverse Engineering Company), Nicola (Official Burp Suite Trainer, PortSwigger), Dhillon (Conference Organizer, HITB)

Conference: HITB Amsterdam

YouTube: https://www.youtube.com/watch?v=yE71wb10se4

Overview

The "Evolution Of Learning: What Cyber Security Training Looks Like In 2023" panel at HITB Amsterdam brought together a diverse group of experts to dissect the shifting landscape of cybersecurity education. Moderated by Matteo Beccaro from Opposing Force, the discussion featured trainers Khalifa Shamsi, Tim, and Nicola, alongside conference organizer Dhillon from Hack In The Box. Their collective insights provided a comprehensive view of how the industry has adapted to global changes, technological advancements, and the persistent demand for skilled professionals.

This talk is particularly relevant for anyone involved in cybersecurity – from aspiring students and seasoned professionals seeking to upskill, to training providers and organizational leaders grappling with the evolving talent gap. The panelists explored critical themes such as the rise of online learning, the importance of specialization, the challenges of bridging the gap between academia and industry, and the increasing role of artificial intelligence in both content creation and practical application. Understanding these dynamics is crucial for fostering an effective and responsive cybersecurity workforce capable of confronting modern threats.

The conversation highlighted not only the practical changes in training delivery and content but also the philosophical underpinnings of effective learning in a rapidly changing field. It underscored that while the tools and platforms for education may evolve, the core principles of deep understanding, continuous practice, and strong mentorship remain paramount for developing truly capable cybersecurity professionals. The panel offered a candid look at the successes, challenges, and future directions for cybersecurity training, providing actionable insights for all stakeholders.

Background

▶ Watch: Panel introduction: Evolution of cyber security training (0:00)

Prior to 2020, cybersecurity training largely revolved around in-person conferences and private corporate sessions. Attendees would travel to events like HITB, engaging in multi-day workshops that offered hands-on experience and direct interaction with instructors. This model, while effective for networking and immersive learning, presented significant barriers related to travel costs, time commitment, and geographical accessibility, limiting participation to a select demographic. The content, while often cutting-edge, was typically delivered in a fixed format, adapting slowly to the rapid pace of technological change.

The global COVID-19 pandemic in 2020 served as a major catalyst, forcing a rapid and widespread shift to online learning. As Dhillon, a conference organizer, noted, initial pushback against virtual trainings was common, with many believing "it's not the same." However, as the pandemic persisted, the technology supporting online delivery quickly evolved. Platforms like Zoom were augmented by collaborative tools such as Discord, and crucially, fully cloud-based lab environments emerged, allowing students to access and replay complex scenarios over extended periods. This technological leap not only mitigated the immediate challenges of remote learning but also fundamentally reshaped expectations for accessibility and value in training.

Simultaneously, the cybersecurity industry continued to grapple with a persistent skill gap – a shortage of qualified professionals to meet the escalating demand for security expertise. Panelists like Dhillon and Nicola highlighted the disconnect between academic curricula, which often struggle to keep pace with the industry's rapidly evolving needs, and the practical skills required by employers. This forced individuals to take "matters into their own hands," seeking specialized, industry-led training to acquire relevant, cutting-edge knowledge. This drive towards specialization, as observed by Nicola, led to a proliferation of focused courses catering to roles like full-time web penetration testers, a significant shift from the more generalized "bit of everything" approach prevalent two decades prior.

Key Findings

▶ Watch: How technology has enhanced online training value (8:00)

The panel discussion revealed several pivotal findings regarding the evolution of cybersecurity training:

1. The Hybrid Model is the New Standard: The post-2020 landscape is characterized by a significant shift towards online and hybrid training formats. While initial resistance to online learning was high, technological advancements in cloud-based labs, virtual machines, and communication platforms (e.g., Discord, Zoom) have made virtual training highly effective. This has drastically improved accessibility, allowing individuals globally to participate without prohibitive travel costs, as noted by Tim. Companies now often send senior engineers to on-site trainings while junior staff attend online versions.

1. Specialization Drives Demand and Quality: The industry has seen a clear trend towards deep specialization. Nicola observed that many of his students are now full-time web penetration testers, a stark contrast to the generalist roles of 20 years ago. This specialization benefits both the quality of work delivered by professionals and the business model for trainers, creating a more identifiable customer base for highly focused courses.

1. Academia-Industry Gap Persists, Self-Learning is Crucial: A significant gap remains between what universities teach and what the industry demands. Dhillon emphasized that the pace of technological change makes it nearly impossible for academic institutions to maintain consistently cutting-edge syllabi. Panelists unanimously agreed that continuous self-learning, particularly through practical challenges like CTFs (Capture The Flag) and online exercises, is indispensable for career success and staying relevant.

1. Effective Training Requires More Than Just Expertise: Being a security expert does not automatically make one a good trainer. Khalifa stressed the importance of developing strong teaching methodologies and content writing skills. Nicola highlighted that trainers must learn to simplify complex concepts, break them into small, digestible steps, and understand that students may not grasp information in the same way the expert does. This pedagogical skill is learned through practice, starting with small workshops and iterating based on feedback.

1. Conference Trainings as a Marketing and Networking Hub: While online training offers unparalleled reach, in-person conference trainings retain unique value. They serve as crucial networking opportunities, enabling students to build professional relationships and interact directly with trainers and peers during non-training hours (lunches, breaks). From a trainer's perspective, public conference appearances act as a marketing tool, generating leads for private, tailored corporate engagements, creating a symbiotic relationship between public and private offerings.

1. AI's Emerging Role in Content Creation and Security: The discussion touched upon the nascent but rapidly growing influence of Artificial Intelligence. Dhillon and Nicola noted the utility of tools like ChatGPT and AutoGPT for rapidly generating basic content structures, ideas, or even boilerplate code for tools like Burp Suite extensions. While current AI-generated content may require significant refinement (e.g., fixing missing Python statements or improving regular expressions), the panelists foresee AI becoming an indispensable "assistant" for trainers and professionals, automating "boring stuff" and profoundly changing the security landscape in areas like malware analysis and defensive tooling.

Technical Deep Dive

▶ Watch: Bridging the skills gap between academia and industry (11:00)

The "technical deep dive" in the context of cybersecurity training, as discussed by the panel, primarily revolves around the evolving methodologies and technologies enabling effective learning and content delivery. The shift from traditional classroom settings to a more dynamic, often remote, environment has necessitated significant technical adaptations.

Central to this evolution are the online platforms and lab environments. Post-2020, trainers like Tim moved extensively to online formats, leveraging communication tools such as Zoom for lectures and Discord for interactive Q&A, peer collaboration, and persistent communication channels beyond the class duration. These platforms provide features like screen sharing, remote control, and direct messaging, attempting to replicate the one-on-one assistance possible in an in-person setting. Nicola, for instance, mentioned using Discord not just for private questions but for a shared server to foster a community around specific knowledge, ensuring all students benefit from answers to collective queries.

The backbone of practical cybersecurity training lies in its hands-on lab environments. Khalifa, whose Active Directory training involves complex on-prem and Azure setups, explained their approach of hosting all labs in the cloud. Students access these environments via RDP connections to a host machine, which then provides access to pre-configured virtual machines. This setup minimizes student-side technical issues (e.g., VMware problems) and allows for robust automation scripts to quickly reset or reconfigure lab components. Crucially, access to these cloud labs is extended for 2-3 weeks post-training, enabling continued practice. Tim, for his reverse engineering courses, provides students with links to virtual machine images that they can set up locally, ensuring they can immediately begin hands-on exercises.

However, not all trainings are easily virtualized. Dhillon highlighted challenges with hardware-dependent training, citing a Bluetooth/RFID course as an example. For such courses, physical hardware must be shipped to participants, underscoring a limitation where direct physical interaction with devices is paramount. This necessitates a hybrid approach, combining remote instruction with distributed physical components.

Content creation and maintenance, particularly for highly specialized and rapidly changing topics, also involve a technical dimension. Nicola, as the official Burp Suite trainer, dedicates a significant portion of his time to updating his 150+ challenges across four days of training. This involves not just updating vulnerabilities but also refining pedagogical approaches, starting with "dumb examples" and progressively adding complexity. The panel also touched upon the nascent but impactful role of Artificial Intelligence in this domain. Tools like ChatGPT and AutoGPT are being explored as assistants for generating basic content structures, outlines, or even initial code for tools like Burp Suite extensions. While current AI outputs may lack the nuance or precision of human expertise (e.g., requiring manual correction of Python statements or refinement of regular expressions, as Nicola observed), their ability to rapidly generate foundational material or suggest strategies for complex problems is a significant technical aid for trainers and students alike. This points to a future where AI could automate the "boring stuff" of content creation, freeing trainers to focus on higher-level concepts and personalized instruction.

Demo / Proof of Concept

▶ Watch: In-person vs. online training: Engagement and networking (47:00)

As this was a panel discussion focused on the broader trends and pedagogical approaches in cybersecurity training, there was no specific technical demonstration or proof of concept presented. The panelists discussed methodologies, experiences, and future outlooks rather than showcasing a particular tool, exploit, or training module in action.

Defensive Implications

▶ Watch: Audience Q&A: AI's impact on cyber security tools (58:00)

The insights from this panel have profound implications for cybersecurity defenders, offering pathways to enhance their skills, build more resilient teams, and stay ahead of evolving threats.

Firstly, the widespread adoption of online and hybrid training models significantly boosts accessibility to specialized knowledge. Defenders who previously faced geographical or financial barriers to attending top-tier conferences or private trainings can now access cutting-edge courses from anywhere. This democratizes access to expertise in areas like Active Directory exploitation (Khalifa's training) or reverse engineering (Tim's courses), enabling a broader base of security professionals to acquire skills crucial for identifying and mitigating advanced threats. Companies can leverage this flexibility to train more employees, including junior staff, thereby strengthening their overall security posture without incurring prohibitive travel costs.

Secondly, the emphasis on specialization directly benefits defensive capabilities. As threats become more sophisticated and targeted, defenders need deep expertise in specific domains, whether it's web application security, cloud security, or incident response. Training programs tailored to these specific needs, as exemplified by Nicola's Burp Suite training, equip professionals with granular, actionable skills to defend against particular attack vectors. This move away from generalized knowledge towards focused mastery allows organizations to build highly skilled teams capable of addressing specific, high-risk areas of their infrastructure.

Thirdly, the panel's discussion on the academia-industry gap underscores the critical need for continuous learning and practical skill development. Defenders cannot rely solely on formal education; they must actively engage in self-learning, participate in CTFs, and apply their knowledge to real-world scenarios. This proactive approach ensures that defensive teams remain current with the latest attack techniques and defensive strategies, adapting rapidly to emerging threats rather than reacting to outdated knowledge. The provision of extended lab access (2-3 weeks, as Khalifa mentioned) post-training is a direct defensive implication, allowing practitioners to solidify their learning and translate it into practical, long-term capabilities.

Finally, the emerging role of Artificial Intelligence presents both challenges and opportunities for defenders. While AI can be used by attackers, it also offers powerful defensive capabilities. AI-driven solutions are already improving areas like antivirus detection and malware analysis. Furthermore, the concept of prompt engineering with tools like ChatGPT and AutoGPT can empower defenders to rapidly generate code snippets for security tools, analyze large datasets, or even formulate defensive strategies. As Dhillon suggested, assuming AI is already being leveraged by adversaries, defenders must proactively understand and integrate AI into their toolkits, not just as a content creation aid, but as a force multiplier for threat detection, incident response, and vulnerability management. This requires training programs to evolve rapidly to include AI literacy and application, preparing defenders for an AI-augmented security landscape.

Key Takeaways

• The Future of Training is Hybrid and Accessible: The post-COVID era has cemented online and hybrid models as the norm, significantly increasing accessibility to specialized cybersecurity training globally, reducing cost barriers, and leveraging platforms like Discord and cloud-based labs.
• Specialization is Paramount for Effectiveness: The cybersecurity landscape increasingly demands deep, specialized expertise. Training programs are evolving to cater to highly focused roles, ensuring higher quality work and more effective defensive postures against targeted threats.
• Continuous Self-Learning Bridges the Academia Gap: Formal education alone is insufficient. Cybersecurity professionals must commit to lifelong learning, utilizing practical challenges like CTFs and real-world application to stay current and bridge the persistent gap between academic curricula and industry needs.
• Trainer Quality Beyond Expertise: Effective training requires not just deep subject matter expertise but also highly developed pedagogical skills. Trainers must simplify complex topics, manage diverse learning paces, and focus on true understanding over rote memorization.
• AI is Rapidly Reshaping Content and Tools: Artificial Intelligence, through tools like ChatGPT and AutoGPT, is becoming a powerful assistant for content creation, problem-solving, and potentially for developing security tools. Defenders must understand and integrate AI into their workflows to stay competitive.
• In-Person Networking Remains Invaluable: Despite the rise of online learning, physical conferences and in-person trainings continue to offer unique value for building professional relationships, fostering community, and providing direct, personalized interaction with trainers and peers.

About the Speaker(s)

Matteo Beccaro (Opposing Force): Matteo served as the moderator for this panel, guiding the discussion on the evolution of cybersecurity training. His role at Opposing Force suggests an involvement in security consulting, training, or related services, placing him at the intersection of industry needs and educational solutions.

Khalifa Shamsi (CEO, Cyber Defense & Pen Testing Co.): With approximately 13 years of experience spanning incident handling in government and offensive security (pen testing), Khalifa has a deep understanding of both sides of the cyber defense coin. He has established his own company specializing in pen testing, offensive security services, and cyber defense, and delivers training on abusing Active Directory (on-prem and Azure) at conferences like HITB.

Tim (CEO, Reverse Engineering Company): Tim is a seasoned expert with 20 years of experience in reverse engineering. Holding a PhD in formal program analysis, he co-founded a company focused on binary rewriting to enhance embedded security. Since 2017, Tim has been delivering specialized training on software obfuscation and general reverse engineering, adapting his methods significantly to online formats post-2020.

Nicola (Official Burp Suite Trainer, PortSwigger): Nicola boasts extensive experience, having been an official Burp Suite trainer for Europe for nearly a decade, seeing over 100 students annually. His expertise is exclusively focused on web application security and the effective use of Burp Suite, making him a specialist in a critical area of offensive security training.

Dhillon (Conference Organizer, HITB): Representing Hack In The Box (HITB), Dhillon provided the crucial perspective of a conference organizer. His insights covered the logistical and strategic challenges of organizing trainings, selecting content, managing attendee expectations, and adapting to the pandemic's impact on event delivery and educational formats.