Strengthening Cybersecurity Potential: Investing in People Instead of Tools! | Markus Schober

### Overview Markus Schober, founder of Blue Cape Security and former principal consultant at IBM X-Force, argues that strengthening cybersecurity resilience requires prioritizing investments in people rather than continually purchasing new tooling. While leadership often leans toward capital expense investments in point solutions, tools without skilled operators lead to underutilization, alert fatigue, and critical detection gaps. Schober presents a practical blueprint for developing structured onboarding, hands-on training, and career advancement paths to improve retention, operational efficiency, and overall security capabilities.

### Key Topics - **Tool-First Mindset vs. Foundational Competency**: Security tools provide an abstracted layer that lacks human context and critical thinking. Relying solely on tool outputs without understanding underlying fundamentals causes analysts to misinterpret alerts or overlook real intrusions. - **The SOC Fatigue and Turnover Crisis**: Referencing data from a Tines report ("Voice of the SOC Analyst"), Schober highlights that 71% of analysts experience burnout, 64% spend over half their time on tedious manual tasks, and 64% consider switching jobs within a year. Repetitive, shallow triage with unclear development paths drives talent drain. - **Underutilization and Maintenance Overhead**: Organizations often operate tools at only a fraction of their capability because analysts are not trained to tune them. Furthermore, managing and maintaining automation and point solutions requires significant ongoing human resources. - **Real-World Breach Lessons**: Schober reviews a CISA advisory where an agency suffered a multi-week intrusion due to ignored EDR alerts, unpatched vulnerabilities, and an unexercised incident response plan that failed to provide third-party responders with necessary access. In another instance, an outsourced MDR team dismissed valid ransomware alerts running from `AppData\Local\Temp` as false positives due to a lack of basic technical knowledge, leading to an entire enterprise network being shut down.

### Technical Details & Training Roadmap To illustrate transforming a security team from basic triage to advanced capabilities, Schober outlines a multi-year "Crawl, Walk, Run" maturity framework: - **Foundations (Crawl)**: Focuses on core enterprise architecture, including Windows domains, domain admin/service accounts, authentication event analysis, credential attacks, and living-off-the-land binaries. - **Detection and Investigation (Walk)**: Expands into host forensics, disk and memory analysis, log triage, and implementing dedicated collection tools such as Velociraptor. Analysts learn to operationalize detection rules (YARA, Sigma) and perform initial malware triage. - **Offensive Emulation and Specialization (Run)**: Analysts operate command-and-control (C2) frameworks and ransomware simulators to see attacks from the red-team perspective. Capabilities mature into cloud incident response, threat intelligence operationalization, purple teaming, and simulated cyber-range exercises.

### Takeaways Effective workforce enablement relies on active, hands-on learning rather than passive listening. Practicing and operationalizing skills in lab environments drives substantially higher knowledge retention. By establishing structured onboarding, guided career roadmaps, and frequent practical workshops, organizations empower analysts to maximize existing tool investments, adapt to evolving attacker tactics, and dramatically boost operational resilience.