RECORD
Toss If Perishable: An Ethnographic Study on Building Scenario-Based Training for Non-Perishable Skills
Cryptography and Security · Submitted 17 Sep 2026
abstract compiled · 2026-09-23 · no language-model review
The authors' main claim Using grounded-theory, we analyzed the data and uncovered factors that inhibit or promote learning of the investigative thinking skills.
The compiled record
The paper's own sentences, arranged. Each label is drawn from a closed vocabulary; the number beside it is the probability the classifier gave that label. Numbers in the tables are the authors', checked by code. No sentence in this record was written by a model.
Open the compiled record
The abstract, sentence by sentence
Security Operations Centers (SOCs) often rely upon on-the-job training focusing on the specific tools and procedures a SOC utilizes. The complexity in tooling can overshadow the underlying reasoning process, hindering an analyst's ability to learn investigative skills. We formulate the concept of "non-perishable knowledge" which corresponds to investigative thinking skills independent of tools. We developed a scenario-driven training method to understand whether such non-perishable knowledge can be imparted through specially designed incident scenarios, where trainees are presented with and solve investigative challenges in a tool-agnostic manner. We designed two such scenarios based on real-world incidents. Human subjects were recruited from a university's student body for ethnographic study to understand how this training method is received by the subjects and how they perform on such tasks. We collected data from 20 hours of documented training with 25 trainees spread across five sessions. Using grounded-theory, we analyzed the data and uncovered factors that inhibit or promote learning of the investigative thinking skills. Our research combines scenario-based training, ethnographic research, and technical analysis to examine how to best train students in the reasoning skills that industry deems vital to SOCs.
background contribution method result interpretation main claim
| # | sentence | role | the authors' own work | states the main conclusion | strength |
|---|---|---|---|---|---|
| s0 | Security Operations Centers (SOCs) often rely upon on-the-job training focusing on the specific tools and procedures a SOC utilizes. | background 1.00 | 0.05 | 0.02 | asserted 0.96 |
| s1 | The complexity in tooling can overshadow the underlying reasoning process, hindering an analyst's ability to learn investigative skills. | background 0.79 | 0.10 | 0.03 | asserted 0.94 |
| s2 | We formulate the concept of "non-perishable knowledge" which corresponds to investigative thinking skills independent of tools. | contribution 0.97 | 0.87 | 0.06 | asserted 0.99 |
| s3 | We developed a scenario-driven training method to understand whether such non-perishable knowledge can be imparted through specially designed incident scenarios, where trainees are presented with and solve investigative challenges in a tool-agnostic manner. | method 0.57 | 0.95 | 0.08 | hedged possibility 0.38 |
| s4 | We designed two such scenarios based on real-world incidents. | method 0.90 | 0.96 | 0.02 | asserted 1.00 |
| s5 | Human subjects were recruited from a university's student body for ethnographic study to understand how this training method is received by the subjects and how they perform on such tasks. | method 0.99 | 0.88 | 0.02 | asserted 0.98 |
| s6 | We collected data from 20 hours of documented training with 25 trainees spread across five sessions. | method 1.00 | 0.96 | 0.02 | asserted 1.00 |
| s7 | Using grounded-theory, we analyzed the data and uncovered factors that inhibit or promote learning of the investigative thinking skills. | method 0.74 | 0.97 | 0.12 | asserted 1.00 |
| s8 | Our research combines scenario-based training, ethnographic research, and technical analysis to examine how to best train students in the reasoning skills that industry deems vital to SOCs. | contribution 0.87 | 0.83 | 0.09 | asserted 0.92 |
What was examined, and what was not
- arXiv listing abstract v1
- full text
- figures and tables
- references and citing sentences
- relations to other papers
- P abstract
- S sections
- T body sentences
- C citations
- R cross-paper relations
The paper
Original abstract
Security Operations Centers (SOCs) often rely upon on-the-job training focusing on the specific tools and procedures a SOC utilizes. The complexity in tooling can overshadow the underlying reasoning process, hindering an analyst's ability to learn investigative skills. We formulate the concept of "non-perishable knowledge" which corresponds to investigative thinking skills independent of tools. We developed a scenario-driven training method to understand whether such non-perishable knowledge can be imparted through specially designed incident scenarios, where trainees are presented with and solve investigative challenges in a tool-agnostic manner. We designed two such scenarios based on real-world incidents. Human subjects were recruited from a university's student body for ethnographic study to understand how this training method is received by the subjects and how they perform on such tasks. We collected data from 20 hours of documented training with 25 trainees spread across five sessions. Using grounded-theory, we analyzed the data and uncovered factors that inhibit or promote learning of the investigative thinking skills. Our research combines scenario-based training, ethnographic research, and technical analysis to examine how to best train students in the reasoning skills that industry deems vital to SOCs.
Human review
Discussion
Know something about this paper? Leave a comment, or highlight any passage above to comment on it.