By Thomas Rogers
Most conversations about building a stronger security team start with certifications. Get the team certified, the thinking goes, and the skills follow. But talk to the people running security teams day in and day out, and a different picture emerges: certifications are a signal of discipline, useful but limited on their own.
Teams that keep getting better tend to be managed differently day to day. The credentials on a resume matter far less than the habits a manager builds into the team’s routine. Building real cyber security manager skills comes down to those habits.
Here’s what that looks like in practice.
Certifications are a signal of discipline
A certification tells you someone started something hard and finished it, which is an undeniable accomplishment. But it doesn’t tell you how someone thinks under pressure, how they communicate when they’re stuck, or whether they’ll ask for help before a small problem spirals out of control. Those are factors that determine whether a security team gets better over time, and they’re harder to teach than any exam syllabus.
Security leaders who hire well tend to look past the score itself and focus on how a candidate talks about the experience:
- How they describe their weakest exam domain
- Whether they can admit what they didn’t fully grasp
- Whether they talk about applying the material, or just passing the test
Certifications work best as one input into a bigger picture, a way to spot commitment alongside other signs of ability. Treating them as the goal instead of a step tends to produce people who are good at studying and untested at doing.
A resume with the right acronyms is easy to screen for, which is exactly why it’s an incomplete filter. Some organizations pair credentials with a structured hiring assessment to see how a candidate reasons through a problem in the moment rather than what they’ve memorized. The strongest candidates can talk through how they’d approach a problem they’ve never seen, instead of only reciting what they’ve already studied.
Psychological safety is the real unlock
None of this works if people are afraid to say “I don’t know” out loud.
Security leaders I’ve talked with say building that kind of safety takes deliberate effort, through habits like:
- Asking the basic question first, modeling that curiosity is welcome at every level
- Giving it time, since teams need months, not days, before they’ll start challenging a manager’s decisions instead of just nodding along
- Letting someone say a project went sideways without it becoming a performance conversation
- Asking a junior analyst what they’d do differently and meaning it
No single policy creates that kind of trust. It comes from small moments, like a manager following through after someone admits a mistake instead of holding it against them later.
Without it, people hide weak spots instead of working on them. Someone who’s worried about looking unprepared will pass on the hard assignment and pick the safe choice instead, and over time that’s a team that never got challenged.
Structured practice beats good intentions
Most organizations already allow time for professional development. New ISC2 research shows 98% support training during work hours, yet 53% still name time and scheduling as obstacles to effective training. The security leaders who get this right block real study time and defend it the same way they’d defend a deadline, instead of leaving it to get squeezed out by tickets and Slack notifications.
The format counts too. A video course you half-watch while monitoring email teaches less than the same hours spent working the material with full attention. One learning and development leader described moving a vendor certification track from video-and-text to hands-on labs and seeing pass rates jump 6x.
Pairing people across specialties does similar work. Put someone strong in network testing onto a mobile assessment, and you’ll find out quickly what they don’t know yet, in a one-on-one debrief instead of a postmortem. That’s how a skills benchmark turns into real coverage instead of an aspirational spreadsheet.
None of this needs a large budget or a formal program. A team lead can block 20 or 30 minutes a few times a week, pick one weak spot, and pair the two people best positioned to work on it together. The structure counts for more than the scale.
Culture outlasts any single skill
Put these together and a team starts to operate differently day to day:
- Certifications get treated as a starting signal rather than a finish line
- Psychological safety gives people room to flag what they don’t know
- Protected time turns practice into a habit instead of an afterthought
People start volunteering for the assignment they’re least confident about, because the cost of being wrong in front of the team is low and the upside of learning is high.
The real goal is a team that’s structurally set up to keep shrinking the distance between where it is and where it needs to be. For anyone responsible for cybersecurity training for a business, that distance is the number worth tracking, more than the certification count.
Thomas Rogers is the Co-founder and President of SkillBit, a cybersecurity skill development platform for enterprise security teams. Learn more at skillbit.com or contact the team to discuss how SkillBit can support your team.
