Are Your Cybersecurity Skills Getting Sharper, or Just Older?

When did your cybersecurity skills last get sharper instead of just older? Here's the harder one. If a control you stood up two years ago quietly lost a step last spring, would your team catch it, or would they inherit the gap and call it the baseline?

If you run security, you already carry this weight. Keep things honest, you answer to auditors and a board that wants a straight answer, and you own the call when a sign-in looks wrong at eleven at night. That's real work, and plenty of shops your size never get it done. So take this as a map: what a security skill really is, the three places it lives, and how to keep yours sharp.

A cybersecurity skill is a craft. It's the practiced ability to apply what you know when it counts, not a fact you own in your pocket or a box you checked. It lives in three places: the standard you set, the way you apply it day to day, and that routine review which maintains it over time. Fed by study and practice, it compounds. Left alone, it decays. That's the whole piece. The rest is how.

The work you already do, and rarely get thanked for

Starting with a word everyone uses but almost nobody cracks open -“Technology”. It isn’t the tool in your hands. Split the Greek and it tells you what it is: tekhne, meaning art, craft, and skill, plus -logy, the study of. So technology is the craft of putting what you know to work in the real world. Owning a thing and applying it with skill are two different jobs.

You already know this, because you live in the gap. Anyone can look up what Conditional Access is. Reading a live policy, predicting what it'll do to a real user, and spotting the flaw in a few moments, that's the craft, and it comes from doing the work, not a class you sat through once.

Here's the part nobody says to you. The security people I've watched come through this do a hard job under real pressure and rarely hear thanks for the night that didn't turn into an incident. CISOs, you turn a technical control into a promise you can defend to a board. IT managers, you keep a queue moving and a team steady when everything's on fire. Engineers, your hand is on the tool, and whether the standard holds or leaks comes down to you. That's craft.

A craft only moves in one of two directions. Studied, it compounds and the team gets faster at reading what's in front of them. Left alone, it thins out while the threats keep moving, the same way the finest Egyptian stonework went rough a few generations later. Same people, same stone. The standard didn't fall. It stopped being met in the hand that held the tool, one dropped step at a time.

Set what's right, and write it down

The first place your skill lives is the standard. Setting one means deciding what "right" actually looks like for your tenant, then writing it down so it outlives whoever set it. It takes real craft to define a standard that's correct, because a documented standard that's wrong just spreads the flaw with perfect fidelity.

Experienced people are quietly good at this and rarely get credit for it. You're the one who decides that "MFA is on" isn't the finish line, because on paper it never was. Every exclusion is a door that opens with a password alone, and the skill is knowing exactly which doors those are and why each one is there. Microsoft's own guidance says an account is more than 99% less likely to be compromised when it uses MFA. Read the fine print, though: that number assumes the real user owns the method. Set the standard loosely and you quietly land on the wrong side of your own statistic.

The pain shows up when the standard lives in one person's head. They leave, or just get busy, and the bar walks out with them. Nobody can say why a policy was built the way it was, so the next person trims it for a deadline and calls that normal. The relief is the opposite. A standard that's written, taught, and defended means a new hire inherits the real thing, not the version with a hole in it. Getting that standard right for your environment, not just any environment, is the work we do together in DTS coaching (explore an introductory session).

Do it right, now

The second place your skill lives is application: doing the work right today and passing it on so the skill genuinely transfers to the next hand. It's where a good standard either gets executed with care or quietly leaks, one step at a time, dropped by someone who never understood why it was there.

Application is the hand on the tool. It's the engineer who knows that traditional MFA, the texted code or the app prompt, beats a password alone and still relays through a convincing fake page. Microsoft names that attack adversary-in-the-middle: a fake page sits in the middle and passes your code and your live session to the attacker in real time. The craft is knowing the difference between a method that got switched on and one that holds when someone comes at it, then moving your important accounts to the phishing-resistant kind, the passkeys and security keys a look-alike site can't use.

Then there's the door most teams forget. MFA is only as strong as the moment someone registers it. An attacker holding a stolen password who reaches the registration page before the real user does can enroll their own phone, and from then on your MFA vouches for them at every prompt. Microsoft flags dormant, unregistered accounts as exactly this takeover risk, a cataloged attacker technique, not a hypothetical. Watching who's actually registering their own methods is a learnable muscle, and building it is the point of our MFA registration coaching (explore an introductory session).

Here's the honest thing about application. You get competent by practice, not attendance. Reading a real policy until you can predict what it does. Sitting with a strange sign-in log until the cause shows itself. Pulling a privileged account into a break-glass drill and watching what breaks. That's real work, and it's what we put in front of your people, not a slide deck. We work your actual environment alongside them until the craft is theirs, from the baseline every tenant should hold (explore an introductory session) to the privileged access (explore an introductory session) most teams only think hard about after a bad night hits.

Keep it right as the world moves

The third place your skill lives is review, and it carries two jobs. It looks, measuring the real work against the standard and catching drift while it's still cheap to fix. And it updates, feeding what it learns back into the standard and how it's applied as threats move. Application keeps you correct today. Review keeps you correct next year.

This is the muscle that separates real confidence from the false kind. False confidence attests that multi-factor is on and moves along, never checking that "on" is the same as covered. Real confidence is the kind you can prove, because someone actually looked. The team that reviews its own registration activity catches the attacker enrolling a fresh authenticator before it becomes an incident. The team that never looks inherits the gap and hears about it from someone else.

Left alone, all three decay together, and you pay to patch over damage that never had to happen, at a cost far higher than doing it right the first time. Fed on purpose, the three compound, and that changes what your team feels like to run.

Here's the part that feels good. A year from now, your people open a policy and spot the missing step in seconds. They see a risky sign-in and know what it means. They defend the posture to an auditor without flinching, because they can explain why each control holds. The skill is written down, taught, and defended. Not because your team is gifted. Because the craft got fed.

So do one thing this week. Pick a single control you turned on a while back and haven't looked at since, and study it like you'll defend it tomorrow. That one honest look tells you which way your craft is already moving. And if you'd rather not do it alone, that's why we're here.

Frequently asked questions

Is cybersecurity a skill you can actually build, or do you just hire it?

It can be built in anyone willing to grow, and an eager team usually is. The skill comes from practice: reading real policies, working real sign-in logs, and doing the hard parts on purpose until reasoning about a control is second nature. Willingness is the part that's hard to teach, and most working security people already have it.

What's the difference between "MFA is on" and being covered?

"On" means the policy exists. "Covered" means it holds when someone attacks it. Every exclusion is a door that opens with a password alone, and older methods like texted codes can be relayed through a fake sign-in page. Being covered means knowing your gaps and closing the ones that matter.

What's one thing I can do today to stop the decay?

Pick one control you enabled a while ago and haven't reviewed since, and study it like you'll have to defend it to an auditor. That single honest look shows whether your standard is holding or has quietly drifted, and it costs you nothing but an hour.

Glossary

Conditional Access: The Microsoft Entra feature that decides whether a sign-in is allowed, and under what conditions, based on who's asking, from where, on what device, and how risky it looks.

Multi-factor authentication (MFA): Requiring more than a password to sign in, like a phone approval or a security key, so a stolen password alone isn't enough to get in.

Phishing-resistant MFA: Stronger sign-in methods, like passkeys and security keys, that a fake login page can't relay or trick a user into handing over.

MFA registration: The step where a user enrolls their own sign-in method. If it isn't guarded, an attacker with a stolen password can register their own device as the account's second factor.

Adversary-in-the-middle (AiTM): A phishing attack where a fake page sits between the user and the real site, relaying the password and the live session token in real time, so the attacker walks in behind a passed MFA check.

Break-glass account: A tightly guarded emergency admin account, kept outside normal policies, used only when everything else locks you out.

Security posture: How strong your defenses are right now, measured by whether controls hold, not by whether they're switched on.