Is cybersecurity training still worth paying for as we head into 2027?

Imagine you've just finished a lab. You followed the video, sent the requests and got the expected result. You read the walkthrough, and it all makes sense.

Then you open another application. This time, the lab title doesn't tell you which vulnerability to look for. Nobody points out the parameter you should change.

Do you know where to start?

When I pay for cybersecurity training, I'm interested in what I can do in that second application. That's also why my answer to the question in the title is still yes.

I'll pay for training that helps me move from following a walkthrough to planning and running my own tests.

In my previous course and exam reviews, I've looked at the depth of the material, the labs and what the assessments actually measure. As we head into 2027, we also need to consider the free resources and AI tools available to someone trying to learn.

A paid course needs to justify its price

We don't need a new course for every gap in our knowledge.

You might need to understand one particular topic. You read some good documentation, examine an example and try it in your own environment. Sometimes, that's enough.

Free resources can also go well beyond the basics. PortSwigger Web Security Academy, for example, provides learning material alongside free interactive labs. A resource's price doesn't tell us how much depth it has.

AI can be useful for examining a piece of code, discussing a mechanism through different examples or looking for gaps in your own explanation.

With these options available, I want to understand why a particular course would help me. A long syllabus or a large number of video hours doesn't answer that on its own.

A clear explanation, a carefully chosen sequence of examples and a lab environment that would take time to build myself all have value. I also want to know what they help me learn to do, and how the course helps me when I get stuck.

What happens when you remove the lab title?

Consider a simple authorization example.

Alice and Bob each have a private document that only its owner should be able to read. While logged in as Alice, you change the document ID in a request and gain access to Bob's document. That's an example you might use when teaching IDOR.

For an introductory lesson, I think it's useful to walk through this step by step. Explain what the request does, which account is being used and which access should be denied.

In the next application, though, there are questions I'd want the learner to answer themselves:

• Which records should this user be able to access?
• What did I change during the test, and what did I keep the same?
• Does the response actually contain another user's private data?
• Does my evidence support the authorization flaw I'm claiming to have found?

A 200 OK response alone isn't enough. We need to examine the response body before claiming that we've accessed Bob's private document.

A title like "IDOR Lab" is useful when you're first learning the concept. As the course progresses, I also want exercises where I have to decide what to investigate.

A different application might have different roles, ownership rules, sharing features or request structures. I should be able to work out the expected behavior in that application and build my test around it.

Knowing when to reduce the guidance

This is where I think a lot of the work in course design happens.

In the first example, the instructor explains how each decision is made. In the next, the learner chooses some of the steps. In another scenario, the conditions change, and the learner has to work out which parts of the previous approach still apply.

I want that progression to be deliberate. Dropping a beginner into a difficult environment without explanation doesn't, by itself, teach them how to research a problem. Showing every step in advance leaves little room for them to make their own decisions.

I have the same expectation for Active Directory training. If a command doesn't produce the result I expected, I should be able to investigate which identity I'm using, which service I'm interacting with and what my current permissions allow. The course should help me connect those pieces.

Difficulty also needs a purpose.

Testing an incorrect assumption, getting an unexpected result and investigating why can be valuable. If I'm spending hours dealing with incomplete instructions or a broken service, I'd want to understand what that is supposed to teach me. If troubleshooting is the learning objective, it should be designed deliberately.

The help available when I get stuck matters, too. Sometimes a small hint is enough. Sometimes I need a prerequisite explained again. When I read a walkthrough, I want to understand why a particular command was the next thing to try.

If Kerberos doesn't click after the first diagram, that's fine. :) The course should help me work out what I'm missing and keep going.

Working with AI also means checking its answers

I think working with AI belongs in the learning process. A course should consider how learners can use these tools thoughtfully.

Imagine asking AI for a test idea. The suggestion might assume that a particular role or sharing feature exists in the application. If that condition isn't present in your environment, a plausible explanation won't make the test relevant.

The same applies to a finding written with AI assistance. Does the result you obtained support the impact described in the report? Did you demonstrate access to another user's data, or did you simply receive a different response?

I'd find it useful for a course to ask me to explain the result in my own words and check my evidence. Changing one condition and asking me to predict how the outcome should change would also be a useful exercise.

Working independently still involves consulting documentation, using tools and learning from other people's experience. We need to be able to adapt that help to our own problem and check the result.

What I look for before paying

I want to see a sample lesson and, ideally, try an exercise. These are the questions I'd ask:

• Are the level and objectives clear? What should I know before starting, and what should I be able to do by the end?
• Does the explanation help me during practice? Does understanding the mechanism help me explain the decisions I make in the lab?
• Is there room to work independently? After the guided example, can I attempt a scenario without the solution in front of me?
• Can I learn from my mistakes? Does the feedback help me understand what I got wrong and how to approach another attempt?
• Does the assessment measure the skill being taught? Am I expected to carry out the task, explain the result and provide evidence where needed?

I don't expect an introductory course to produce advanced expertise. I do expect it to answer those questions consistently at the level it promises.

I look at certifications in the same way. A certification can be meaningful when it represents skills demonstrated within a defined scope. The level, assessment conditions and method should be clear.

If a course provides that experience, fits what I need and helps me notice things I would miss while studying alone, I still consider it worth investing time and money in.

If you'd like to start with free material

If you want to get started or strengthen your fundamentals, you can take a look at hacker.directory, my community project. The web and Active Directory material is free.

The web content explores the journey of an HTTP request and how browsers behave. The AD content looks at identity, permissions and trust relationships, using visual explanations and short practical exercises. For me, "Understand what you hack" starts with understanding how a system normally works and questioning the assumptions it relies on.

As we head into 2027, good cybersecurity training is still worth paying for.

I want to see that value the next time I'm working with an unfamiliar system. If I have a clearer idea of what to investigate, why I'm investigating it and how to verify what I find, that course has been worth paying for.