Cybersecurity is not learned through memorization. It is developed through participation.

The threat landscape is always changing. The tools we use continue to evolve, and adversaries are constantly adapting their tactics.

Professionals develop their skills through real-world experience, engaging in authentic investigative work within the actual constraints they will face on the job.

If we are preparing learners for professional roles in Security Operations Centers (SOCs), our environments must reflect how professionals actually develop.

Recent research and new implementations have led to adaptive, AI-driven SOC simulations that are grounded in both technical realism and proven learning theory. The goal is not just to have students complete cybersecurity exercises, but to prepare them to become true cybersecurity professionals.

Learning to Become a Cybersecurity Professional

Becoming a cybersecurity professional is about more than just learning skills. It also involves developing a sense of professional identity.

Learners need to start thinking, reasoning, and making decisions the way experienced practitioners do. This process is supported by research on situated learning and communities of practice.

In operational SOCs, analysts do not learn in isolation. They participate in a shared practice:

• Interpreting alerts
• Negotiating evidence
• Managing uncertainty
• Escalating incidents responsibly

The adaptive SOC simulation is designed to recreate this kind of participation. Learners work with real-world telemetry, such as SIEM alerts, IDS events, and incident tickets, in a production-grade environment that mirrors the systems used in today’s SOCs.

They are not completing abstract assignments. They are participating in a professional activity.

Over time, this kind of participation helps learners move from observing at the edges to taking on more central responsibilities, which is a key part of how professionals develop in real communities of practice.

From Static Labs to Adaptive Skill Development

Traditional cybersecurity labs often rely on fixed pathways. Every learner receives the same alert stream, progresses at the same pace, and encounters identical levels of difficulty.

However, professional growth does not follow a straight path, and it is not the same for everyone.

Learning science tells us that development occurs within the Zone of Proximal Development, where individuals are challenged just beyond their current capabilities, but succeed with proper support and guidance. Static labs cannot reliably create this learning environment. They either overload novices or underserve advanced learners.

An adaptive system can change this dynamic by responding to each learner’s individual needs.

By continuously evaluating a learner’s performance across security domains, such as log analysis, correlation, incident documentation, and attribution reasoning, the system can adjust difficulty in real time. When conceptual gaps appear, instructional support increases. As competence strengthens, it fades.

This approach ensures learners are challenged at the right level. Progress is based on demonstrated mastery, not simply on the amount of time spent on a task.

The result is a learning environment that matches how real expertise develops in the workplace.

Experiential and Deliberate Practice

Research shows that people build real competence through deliberate practice that includes frequent feedback.

At the same time, it reflects Kolb’s experiential learning cycle, where knowledge is built through experience and reflection:

• Concrete experience (incident investigation)
• Reflective observation (AI-guided inquiry and instructor feedback)
• Abstract conceptualization (pattern recognition and threat modeling)
• Active experimentation (subsequent scenario engagement)

With each cycle, learners strengthen their analytical judgment and decision-making skills.

The simulation environment serves as a structured space where learners can practice and refine their professional reasoning.

Differentiated Growth Within a Shared System

In any cohort, learners enter with varied prior experience. One may rapidly correlate multi-vector attacks. Another may require reinforcement in packet-level interpretation.

The adaptive system helps ensure that all learners are challenged at the right level. Advancement is based on mastery, not on time spent, and the complexity of tasks increases only when learners are ready for it.

There is no public ranking. There is no artificial pacing.

Growth is personalized for each learner, but everyone is still working within a shared professional environment.

This approach reflects what happens in real SOCs, where analysts develop at different speeds but still work together within the same system.

AI as Augmentation, Not Replacement

A key principle behind this design is that AI should support and enhance human reasoning, not replace it.

The AI layer integrates directly with SOC telemetry, enabling contextual prompts grounded in live incident data. Learners remain responsible for analysis, documentation, and decision-making.

This preserves professional accountability.

The instructor remains central to judgment, mentoring, and ethical framing. AI extends access to calibrated support but does not remove the cognitive work required for expertise formation.

In this way, the system is built around human-centered design, with technology supporting learning and development rather than taking over.

Implications for Institutions and Employers

When adaptive SOC simulations are grounded in proven learning theory, their impact extends to learners, faculty, and employers.

For learners, their experience is personalized and structured:

• Development is scaffolded within their Zone of Proximal Development.
• Cognitive load is intentionally managed.
• Mastery progression replaces fixed pacing.
• Identity formation emerges through participation in authentic practice.

For faculty, their role becomes more focused and impactful:

• Time shifts from repetitive scenario design toward mentoring higher-order reasoning.
• Assessment becomes performance-informed and domain-specific.

For employers, this results in graduates who are ready to contribute:

• They have participated in a socio-technical activity system that mirrors operational reality.
• They have navigated authentic telemetry, managed tickets, and exercised judgment within escalating complexity.
• They have not merely studied security operations but practiced them.

A Theoretical and Instructional Shift

This work represents more than a technological enhancement.

It reflects an instructional architecture grounded in:

• Situated learning
• Communities of practice
• Mastery learning
• Cognitive load management
• Deliberate practice

The adaptive SOC model shows how AI can be used thoughtfully and ethically to help learners become professionals.

Cybersecurity education needs to evolve as quickly as the threat landscape changes, but that evolution should be guided by clear principles.

The future of cybersecurity training will be shaped by environments that are immersive, responsive, and closely aligned with how professionals actually learn and grow.

The task before us is not simply to build more advanced labs.

Our goal should be to design learning systems that help students build judgment, adaptability, and a strong professional identity, so they are prepared not only to respond to threats, but also to grow alongside them.

That is the deeper promise of adaptive, theory-informed cybersecurity education.

 

About the Author: Keith A. Morneau

Dr. Keith Morneau is an experienced cybersecurity professional and the current Dean of Computer and Information Science at ECPI University. He has over 20 years of experience in cybersecurity education and has helped ECPI University become a National Center of Academic Excellence in Cyber Defense Education. Dr. Morneau is also an ABET CAC Commissioner and Team Chair for cyber programs and has secured several grants and published papers to advance cybersecurity education. His research interests focus on workforce issues and bridging the skills gap in cybersecurity professions.