Cybersecurity tutorial hell: how to get out
Forty hours of video and you still can't explain a man-in-the-middle attack? Why courses train recognition, not recall, and a two-minute routine to get out.
On this page
Hurray! You finished the course. Forty hours of video, a certificate at the end, and a folder of notes you will never open again. Then a friend asks how a man-in-the-middle attack works, and you simply say, "So basically, someone sits in the middle."
Learners (and we) call this cybersecurity tutorial hell. You keep watching because watching feels like progress, and every new course promises to be the one that finally makes things right, or gets you towards your "dream job". It rarely is, because whatever makes things click was never in the video.
Why watching feels like learning
A good instructor makes everything look easy. They pause at the right moment, the demo works for the first time and the explanation flows. You follow each step and nod along.
But following along is a different skill from producing an answer yourself.
You can recognise a correct explanation when you see one far more easily than you can build one from nothing. Courses mostly train recognition. Interviews, incidents and real work ask for recall.
The roadmap problem
Roadmaps make this worse. Search for one and you will find a dozen, all confident and all different. Learn networking, then Linux, then Python, then a certification, then specialise. Each is one person's path, drawn up after the fact and presented as the route. Some are useful. A lot of them are a list of topics in an order that looks tidy on a graphic.
The bigger cost is quieter. If you follow a roadmap letter to letter, you only ever study what it tells you to study, and you never wander into the corner that can turn and hold your attention. Some people find out they love incident response, malware analysis or cloud security only because they stumbled into it, NOT because someone told them to!
A roadmap cannot tell you which one will be yours, and neither can a video. You find out by trying different things and noticing which ones you keep going back to.
Explain it out loud
The way out is not another course. It is to start producing something. Take a topic you have just watched or read and explain it out loud, with no notes, to an imaginary person who knows nothing about it. Two minutes is enough. Say it the way you would to a friend, then listen for the gaps.
This works because explaining forces you to retrieve what you know instead of recognising it. At some point a sentence will refuse to finish. You will hear yourself say "it does the thing with the token" and realise you have no idea what the thing is. That is the exact spot to go back to, and a video can never show it to you. Only your own mouth can.
A routine you can start today:
- Pick one small topic, such as "how a JWT is verified" or "what a reverse shell actually does".
- Spend ten minutes reading or watching, and stop there.
- Close everything and explain it for two minutes, out loud.
- After transcription, read it again, word to word. Mark every place you hesitated, repeated yourself or used a word you could not define.
- Fix only those places, then explain the same topic again tomorrow.
Where cardosec fits
cardosec is built around this routine. You choose a field and a mode, such as Explain it, Incident drill, Deep dive or Interview, then draw a topic at random. You research it, explain it out loud against a timer, and get feedback on what you covered and what you missed, from the AI provider you connect with your own key.
Because the draw is random, you end up in corners that no roadmap would have sent you to.
Try one before you close this tab
Someone logs in to the same account from two different countries within ten minutes. What do you check first, and why? Say your answer out loud, in under two minutes, without looking anything up.