Ilmu Komputer & AI editorial
Open AccessOA2026
Toss If Perishable: An Ethnographic Study on Building Scenario-Based Training for Non-Perishable Skills
A tool-agnostic, scenario-driven approach to cultivating investigative thinking in Security Operations Centers
Francis Hahn; Spencer Cherry; Kumar Shashwat; Laura Araujo Buldrini; Daniel Lende; Xinming Ou· 2026· DOI 10.48550/arXiv.2609.21147
The core problem
Security Operations Centers (SOCs) frequently depend on on-the-job training that emphasizes the specific tools and procedures in use. However, the complexity of modern tooling can overshadow the underlying reasoning process, impeding an analyst's ability to develop core investigative skills. The authors introduce the concept of **non-perishable knowledge**, defined as investigative thinking skills that remain valuable regardless of the tools employed. They pose the research question: can such non-perishable knowledge be imparted through specially designed incident scenarios where trainees solve investigative challenges in a tool-agnostic manner? To explore this, they developed a scenario-driven training method and conducted an ethnographic study with human subjects recruited from a university's student body. The study aims to understand how this training method is received and how participants perform on such tasks, ultimately uncovering factors that inhibit or promote the learning of investigative thinking skills.
Innovation
The study collected data from 20 hours of training involving 25 trainees across five sessions. The ethnographic analysis revealed various factors that either inhibit or promote the learning of investigative thinking skills. While the abstract does not enumerate specific results, the grounded-theory approach uncovered patterns in how trainees engaged with the tool-agnostic scenarios. The authors likely observed differences in performance and reception, which are detailed in the full paper. The results section would typically present these findings, possibly including qualitative themes and illustrative examples from the training sessions.
Security Operations Centers (SOCs) frequently depend on on-the-job training that emphasizes the specific tools and procedures in use. However, the complexity of modern tooling can overshadow the underlying reasoning process, impeding an analyst's ability to develop core investigative skills. The authors introduce the concept of **non-perishable knowledge**, defined as investigative thinking skills that remain valuable regardless of the tools employed. They pose the research question: can such non-perishable knowledge be imparted through specially designed incident scenarios where trainees solve investigative challenges in a tool-agnostic manner? To explore this, they developed a scenario-driven training method and conducted an ethnographic study with human subjects recruited from a university's student body. The study aims to understand how this training method is received and how participants perform on such tasks, ultimately uncovering factors that inhibit or promote the learning of investigative thinking skills.
The authors designed two training scenarios based on real-world incidents. These scenarios were presented to trainees in a tool-agnostic manner, requiring them to solve investigative challenges without relying on specific SOC tools. Human subjects were recruited from a university's student body, and data were collected from 20 hours of documented training with 25 trainees spread across five sessions. The training sessions were observed ethnographically, and the collected data were analyzed using grounded-theory to identify factors that influence learning. The research combines scenario-based training, ethnographic research, and technical analysis. The overall workflow can be represented as follows:
Why it matters
The discussion interprets the findings in light of the concept of non-perishable knowledge. The authors argue that scenario-based training can effectively impart investigative thinking skills that are independent of specific tools. They discuss the factors that inhibit or promote learning, such as the complexity of tooling, the design of scenarios, and the trainees' backgrounds. The study contributes to the fields of cybersecurity education and SOC training by offering a method that focuses on durable reasoning skills. The authors also reflect on the limitations of their ethnographic approach and suggest directions for future research, such as scaling the training and assessing long-term retention of non-perishable knowledge. The research underscores the importance of tool-agnostic training in preparing analysts for evolving threat landscapes.
Who should read this
CS practitioners and researchers
Opening member content…