Why you forget cybersecurity concepts (and what to do)
Forgetting is memory's default. Why security concepts fade faster, why rereading your notes doesn't fix it, and a revisit-and-explain routine that does.
On this page
You've landed on this blog because you relate to it. Now DON'T SKIP till the end!
Last month you spent an evening on Kerberos. You followed the diagrams, you understood why the tickets exist, you even felt a little smug about it. Today a colleague mentioned Kerberoasting and all you can produce is "something about tickets?"
Nothing is wrong with you. Forgetting is what memory does by default. The German psychologist Hermann Ebbinghaus measured it in the 1880s, and the finding has held up since:
What you learn fades quickly unless you come back to it. Security does not get an exemption just because the material feels important.
Why security makes it worse
Most fields have this problem. Security has a few extras on top.
First, concepts sit on top of each other. TLS rests on certificates, hashing and key exchange. Kerberos rests on tickets, clocks and DNS. If one of the lower pieces has gone fuzzy, the thing above it gets shaky too, and you often do not notice until someone asks a follow-up question.
Second, the field rewards chasing the new. A fresh CVE or tool is always trending, so it is easy to spend months on the latest thing and let the basics slide quietly.
Third, a lot of us learn in bursts. A bootcamp week, a weekend CTF, a course finished over one holiday, and then nothing for a month. That is close to the worst schedule for memory.
Re-reading is not revisiting
The usual fix is to open the notes and read them again, or watch the video at double speed. It feels productive because everything looks familiar. But familiar is not the same as remembered.
Revisiting only counts if you try to pull the idea out of your head first. Looking things up comes second.
Revisit, then explain
cardosec is built for this loop. You choose a field and a mode, such as Explain it, Incident drill, Deep dive or Interview, and draw a topic. You research it, then explain it out loud against a timer and see what you covered and what you missed, using the AI provider you connect with your own key. Your history keeps a record of the cards you have drawn, so you can look back at what you studied and go over it again.
Here is the version that works, and it takes a few minutes at a time rather than hours.
- At cardosec, revisit the log list of what you have studied, with the date next to each topic.
- The next day, pick another card and explain it out loud for two minutes. No notes, no tabs.
- Do the same again roughly a week later, and again about a month later. The exact gaps matter less than the habit of coming back. However, you can also get it with a single click from the "Quiz me" tab curated to test your memory.
- Each time, mark the cards where you stalled. Only those parts get re-read.
- Once a week, add one fundamental to the pile, even if you believe you know it.
Explaining is the important part, but reviewing your strength and recalling the concepts you have covered from time to time is equally important. Saying a concept out loud makes any hole obvious in a way that silently nodding at your notes never does. If you can describe how Kerberos issues a ticket to someone who has never heard of it, you know it. If you cannot, you have found what to fix, and it only took two minutes.
It also helps to be honest about what knowing means. If you can only recognise the word Kerberoasting, you know the word. If you can say who is allowed to request those tickets and why they can be attacked offline, you know the concept. Only the second one helps you in an interview.
Fundamentals are not just for the beginners
During an incident, whether you check DNS logs or the auth logs first depends on how well you understand how those systems behave. In an interview, the question that trips up a confident candidate is often something like the difference between authentication and authorisation, or what happens when you type a URL and press enter.
Those are the topics that get revisited least, because they feel too simple to bother with.
That is exactly why they decay.
Start with one you probably know
What happens between typing a web address and the page appearing? Explain it for two minutes, out loud, with nothing open. Notice where you slow down.