Making Invisible Cognitive Processes Visible in Cybersecurity Training

The problem that the capstone named

In March 2026, I defended a doctoral capstone at the University of Miami with the title Bridging Art and STEM: A Mixed-Methods Study Examining Whether Explicit Instruction and START Mapping Enable Art Students to Recognize STEM Processes in Creative Work. The study was small on purpose. Sixteen students, pre-post design, qualitative coding of written artifacts alongside quantitative change scores. The question was narrow. The answer was more consequential than the question's scale suggested.

Art students performing creative tasks routinely execute the cognitive moves that STEM education treats as its own. They decompose problems. They iterate on solutions. They generate and test hypotheses. They revise based on evidence. What they usually lack is the vocabulary to label those moves as STEM. When the vocabulary is absent, the student and the evaluator both miss the fact that STEM-relevant reasoning has been happening all along. Ritchhart, Church, and Morrison^[1] articulated the broader pedagogical version of this problem in Making Thinking Visible. Their argument was that learning cultures that surface cognitive moves produce learners who can direct their own further growth, and learning cultures that leave the moves implicit produce dependency on external validation.

The cybersecurity career transition presents the same structural problem at a different altitude. Adult learners entering cybersecurity from information-technology support, software engineering, compliance, military service, teaching, or unrelated fields routinely perform the reasoning the field values before they learn the vocabulary the field uses. They already triage incoming signals by likelihood and severity. They already construct narratives of what happened and why. They already work across ambiguity and hand off their findings to colleagues. What they lack is the vocabulary to name these moves as SOC analyst work, incident response, threat modeling, or detection engineering. And hiring systems that gate on vocabulary miss them.

This essay argues that the most valuable intervention in cybersecurity career transition programs is not teaching more technical content, which the learner can self-acquire. It is making the learner's existing reasoning visible to the learner and to the prospective employer. Four bodies of peer-reviewed work converge on this conclusion. The practical implications are concrete enough that DecipherU's assessment instruments and learning paths are designed around them.

The invisible-reasoning trap in cybersecurity hiring

The U.S. Bureau of Labor Statistics reports a median annual wage of $124,910 for information-security analysts as of May 2024^[15]. CyberSeek's 2026 heat map shows approximately 469,000 open cybersecurity roles in the United States, with a supply-demand ratio of 0.85^[16]. These figures are widely cited and genuinely describe a tight labor market. The paradox the figures hide is that the same tight labor market rejects adult career changers with adjacent reasoning skill at substantial rates, and the rejection rarely reflects absent competence. It reflects absent vocabulary.

Consider a helpdesk technician with eight years of experience who has never worked in a security operations center. When a user's laptop is showing unusual behavior, she has almost certainly performed the work of alert triage, correlating the user's report with historical patterns she has seen before, prioritizing her response based on a mental model of likelihood, ruling out benign explanations, escalating when something does not fit. This is the reasoning of a SOC analyst. When she applies for a SOC analyst role, the recruiter screen asks whether she has experience with Splunk, CrowdStrike, and MITRE ATT&CK. She does not, and so the resume is filtered out. The competence is present, but the vocabulary that makes the competence visible is absent. The labor-market statistic captures the open role, not the qualified candidate who was invisible to the filter.

This is a problem of asymmetric information in the sense Spence^[12] described in his Nobel-recognized 1973 signaling paper. The employer cannot directly observe the candidate's productivity before hiring. Signals stand in for observation. Certifications signal because they are costly to acquire for low-ability candidates. Degrees signal. Work history in the field signals. The adult career changer lacks the signals that industry infrastructure produces, but does not lack the underlying ability. The result is an efficiency loss to both the candidate and the hiring firm.

The response most often proposed to this gap is teaching the vocabulary. Bootcamps, certifications, and introductory courses claim to close the gap by covering SIEM tool vocabulary, threat-model jargon, and compliance-framework terminology. These programs are useful but misaddress the underlying problem. The learner who acquires vocabulary without also making their reasoning visible still fails the interview when the interviewer asks how she would approach a triage scenario, because the scenario is not recitable. It requires surfacing the reasoning she already performs but has never been asked to describe in the vocabulary of the field. Ritchhart and colleagues^[1] would predict this exact outcome. Vocabulary without visible reasoning produces brittle performance under any pressure.

What the learning-sciences literature prescribes

Four traditions from the adult-learning literature converge on the same design response. They disagree on framing and on emphasis, but they agree on mechanism. I summarize each briefly because each also does independent work in the sections that follow.

Knowles' andragogy^[5] articulates six assumptions about adult learners that differ from assumptions about children. Adults need to know why they are learning something before they commit. They bring substantial life experience into the classroom. They orient toward learning that helps them perform specific roles or solve specific problems. They are internally motivated when they choose the path themselves. They prefer immediate application over deferred theory. Their self-concept is rooted in self-direction rather than dependency on an instructor. Every one of those assumptions argues against the bootcamp pattern that treats the adult learner as an empty vessel and fills them with vocabulary before asking what they bring.

Vygotsky's zone of proximal development^[2], extended by Wood, Bruner, and Ross^[9] with the concept of scaffolding, describes the gap between what a learner can do alone and what they can do with expert guidance. Meaningful learning happens inside that gap. Tasks too easy produce boredom. Tasks too hard produce failure and disengagement. Inside the zone, scaffolded practice produces competence. The practical implication for cybersecurity career transition is that the first entry role should be zone-matched to the career changer's existing competence, not either inflated (junior pentester for a candidate with no adjacent skill) or deflated (another round of cert prep when the candidate already has three certs and no portfolio).

Bandura's self-efficacy theory^[3][4] identifies four sources of domain-specific belief in one's capacity to produce a specific outcome. Mastery experiences are successful performance in the domain. Vicarious experiences are watching similar others succeed. Verbal persuasion is credible others communicating confidence. Physiological state is the body's signals during the task. Career changers are typically weak on all four sources at the start of the transition. The programmatic implication is that each source is engineerable. Small wrappable wins produce mastery experiences. Cybersecurity communities provide vicarious experiences. A credible mentor provides verbal persuasion. Deliberate regulation of study sessions produces the physiological regulation. Learners who run a weekly self-efficacy audit across the four sources predict their own persistence at rates substantially higher than motivation-based alternatives.

Kolb's experiential learning cycle^[7] organizes learning into four phases: concrete experience, reflective observation, abstract conceptualization, and active experimentation. Kolb argues that meaningful learning requires cycling through all four phases, and that skipping phases produces characteristic failures. For cybersecurity career transition, the cycle maps cleanly onto a weekly study cadence. Lab work is concrete experience. Written reflection on what happened is reflective observation. Reading one source and tying it to the lab is abstract conceptualization. Modifying next week's lab based on the reading is active experimentation.

These four traditions converge on a practical design: the adult cybersecurity career changer should be asked to surface their existing reasoning before acquiring more vocabulary, should be zone-matched to a first role that makes their existing competence legible, should engineer self-efficacy experiences rather than rely on motivation, and should cycle through Kolb's four phases every week rather than grind through lecture content. The convergence is not accidental. It reflects a common underlying model of adult learning that the field has refined for half a century.

What the capstone found and why it generalizes

The capstone study at the University of Miami used a mixed-methods pre/post design with n=16 art students working on creative tasks with STEM-relevant cognitive demands. Pre-intervention, the students completed a written artifact describing the reasoning they used in their own creative work. The intervention was a brief session of explicit instruction on STEM process vocabulary coupled with START mapping, a structured prompting framework that asked students to label the moves they were already making in the specific vocabulary the STEM fields use. Post-intervention, the students completed a second artifact under the same conditions.

The quantitative shift was meaningful. The qualitative shift was larger. Students moved from describing their creative process in aesthetic terms toward describing the same process with a hybrid vocabulary that named both the aesthetic and the STEM structural components of their work. The crucial observation was that the reasoning did not change. The students did not perform new cognitive moves after the intervention. They labeled the moves they had already performed with language that made those moves legible to evaluators trained in STEM rather than only in art. Making thinking visible, in Ritchhart and colleagues'^[1] sense, is not a pedagogical nicety. It is the unlock that converts implicit competence into visible competence.

The cybersecurity parallel is direct. The helpdesk technician I described earlier already performs SOC-analyst-grade reasoning. She does not need to learn how to triage a signal. She needs to be taught the vocabulary of triage in the domain and given structured prompts that ask her to label what she already does. A one-week intervention of this kind shifts her visible competence more than a twelve-week introductory course that assumes she starts empty. The principle is independent of the domain. It is a principle about adult learners with adjacent competence, and it applies anywhere the vocabulary is the gate.

There is a limit to this generalization that the capstone was careful to name. The intervention works on learners whose adjacent reasoning is present in a way that maps onto the target domain. It does not conjure reasoning that is not there. A candidate whose prior work has not involved signal triage will not benefit from a vocabulary-only intervention targeting the SOC analyst role. For that candidate, Vygotsky's ZPD^[2] prescribes different scaffolding: introduction of the underlying cognitive move through concrete exercise, rather than vocabulary alone. The judgment about which candidate is which is itself the assessment problem, and is what DecipherU's readiness assessments are designed to surface.

The assessment design that follows

The DecipherU readiness assessments, including the SOC Analyst Readiness, Pentester Readiness, Cloud Security Readiness, DevSecOps Readiness, and Malware Analyst Readiness instruments, are designed to surface adjacent reasoning rather than test vocabulary retention. Each assessment presents the candidate with a realistic shift scenario, asks for a free-text decision, and scores the decision against a rubric whose concept bank includes both English and Spanish and Portuguese synonyms. The candidate does not need to write in the formal vocabulary of the field to earn credit. She needs to demonstrate the underlying reasoning, and the rubric catches the reasoning even when the surface vocabulary is adjacent rather than native.

This design choice is not cosmetic. It embodies the capstone finding in an assessment artifact. Candidates whose reasoning is present in adjacent vocabulary score substantially higher than a vocabulary-gated instrument would allow. The rubric is not permissive. It still evaluates the quality of the reasoning. What it does not do is gate on terminology that the candidate could acquire in a week if her reasoning is strong. The bottleneck in career transition is reasoning, not vocabulary, and the assessment is built accordingly.

The signaling theory implication is that a candidate who completes a readiness assessment and earns a strong score has produced a signal that is costly to fake^[12] in the specific way that certifications fail to be. Certifications signal that the candidate can pass an exam. A readiness assessment signals that the candidate can reason about a real shift scenario at the quality bar the field requires. The hiring manager who reads both gains texture that a certification alone cannot provide.

Asking the candidate to write and scoring the writing has a second effect that the capstone literature names clearly. The act of surfacing reasoning in writing changes the learner's own relationship with the reasoning. The candidate who describes her triage logic in 250 words of prose does not just produce a signal. She produces a mental map of her own competence that she did not have before the exercise. Ritchhart and colleagues^[1] call this the reflexive benefit of making thinking visible. It is why DecipherU assessments produce written results pages that describe the candidate's strengths and development areas in ordinary English. The result is meant to be legible to the candidate herself, not just to a future hiring manager.

The learning-path design that follows

The same research foundation shapes the DecipherU Cybersecurity Career Transition learning path, a six-module course grounded in Knowles, Mezirow, Kolb, Bandura, Vygotsky, and Dreyfus^[8]. Rather than walking the career changer through technical content the way most introductory cybersecurity programs do, the course asks the learner to engage with the decision architecture first. Module one is Knowles and Mezirow. Whether to transition at all. Module two is Vygotsky and Bandura. Which first role matches the learner's existing competence. Module three is Kolb and Ericsson^[10]. How to structure weekly study so the learner cycles through all four phases of the experiential learning model rather than drilling on content. Module four is Spence and Ritchhart. What artifacts demonstrate adjacent reasoning to a hiring manager.

The sequence matters. A course that began with technical content would fail the first Knowles assumption, the need to know. A course that began with vocabulary would fail the Ritchhart prescription. The first four modules of the course ask the learner to do exactly what the capstone intervention asked the art students to do: surface their own reasoning in writing, using structured prompts, before acquiring more domain-specific vocabulary. The written artifacts produced by the learner during the course function both as a signal to hiring managers and as a mental-map construction exercise for the learner herself.

Module five, on interviewing, applies the same logic to the interview conversation. Rather than memorize answers to 200 possible questions, the learner is asked to recognize the six recurring behavioral patterns that cybersecurity interviews test, and to produce twelve prepared answers for each pattern. This is an application of Ericsson's deliberate practice framework^[10]. The learner operates at the edge of capability on a specific sub-skill, receives immediate feedback from a mentor or study partner, and iterates. The twelfth iteration is typically where competence emerges. It is not a motivational claim. It is an empirical regularity observed across domains from chess to surgery.

Module six, on sustaining the first 90 days on the job, draws from newcomer socialization research^[13][14]. The career changer arrives at the first cybersecurity role with technical preparation and usually neglects the five non-technical dimensions (people, politics, language, goals and values, history) that Ashforth and Saks documented. A weekly six-dimension audit predicts twelve-month retention better than technical performance alone. The practical consequence of getting this right is not academic. It is the difference between a career changer who stabilizes and compounds in the field and one who churns out in the first year.

Limits of the approach

This approach does not replace technical preparation. A SOC analyst still needs to learn the tools of the trade. An incident responder still needs to know the MITRE ATT&CK framework. The approach shifts the sequencing and the emphasis. Reasoning first, vocabulary second, tool fluency third. In practice, all three run in parallel, and the ratios vary by learner and by target role. The design principle is that reasoning is the bottleneck, and treating it as a bottleneck changes which interventions are worth doing first.

The approach also assumes that the candidate has adjacent reasoning to surface. A candidate whose prior work has not included the cognitive moves the target role requires cannot be helped by vocabulary alone. For that candidate, the Vygotskian prescription applies: scaffolded introduction to the underlying cognitive moves through concrete exercise. The judgment about which candidate is which is itself the assessment problem, and no single instrument resolves it completely. The practical resolution in the DecipherU pipeline is to offer multiple readiness assessments across adjacent roles and let the candidate's own pattern of results guide role selection. A candidate whose SOC Analyst Readiness is moderate and whose Cloud Security Readiness is strong should target cloud security, regardless of which role she initially preferred.

A third limit concerns the durability of the gains. The capstone intervention was brief. The post-intervention artifacts reflected a one-week shift in visible reasoning. Whether the gains persist at three months or twelve months is an open question the original study was not designed to answer. The cybersecurity career transition is a multi-year project. Making invisible reasoning visible at the start is necessary but not sufficient. Ongoing practice, community, mentorship, and deliberate self-efficacy engineering all matter for the longer horizon. The DecipherU learning path addresses each of these explicitly, which is why it is a six-module course rather than a one-week intervention.

A closing note on the work ahead

The capstone study was small. Sixteen students at one institution. The next research step is a replication in a cybersecurity-specific sample with a larger n and a multi-month follow-up. Schön's reflective-practitioner framework^[11] suggests that the follow-up should not be limited to controlled intervention designs. The career changers who use DecipherU's readiness assessments and learning paths produce their own artifacts, and those artifacts constitute a longitudinal data set that can be studied as design-based research.

For candidates currently considering a cybersecurity transition, the prescription is specific. Before buying a certification voucher, write a two-page memo that answers Knowles' six questions in your own context. Before enrolling in a bootcamp, take a readiness assessment that surfaces your existing reasoning against the target role's cognitive demands. Before committing to a first role, complete a ZPD diagnosis across the three or four adjacent roles you are considering. The prescription is unglamorous. It works because it respects what the evidence says about how adults learn.

For hiring managers and program leads reading this essay, the prescription is different but related. The candidates being filtered out by certification-based screens are not necessarily less competent than the candidates being filtered in. They are less visible. The recruiter screen, the resume-review software, and the vocabulary-heavy interview are each filters that select on signals that adult career changers from adjacent backgrounds lack. Rebuilding the top of the funnel to include artifact-based evidence, readiness assessments, and structured walkthroughs of adjacent reasoning can surface candidates whose subsequent performance equals or exceeds the candidates the old funnel selected. The empirical basis for this claim is the same basis that grounded the capstone. Making thinking visible changes who gets counted.

References

1. [1]Ritchhart, R., Church, M., & Morrison, K. (2011). Making thinking visible: How to promote engagement, understanding, and independence for all learners. Jossey-Bass.
2. [2]Vygotsky, L. S. (1978). Mind in society: The development of higher psychological processes. Harvard University Press.
3. [3]Bandura, A. (1977). Self-efficacy: Toward a unifying theory of behavioral change. Psychological Review, 84(2), 191-215. https://doi.org/10.1037/0033-295X.84.2.191
4. [4]Bandura, A. (1997). Self-efficacy: The exercise of control. W. H. Freeman.
5. [5]Knowles, M. S., Holton, E. F., & Swanson, R. A. (2015). The adult learner: The definitive classic in adult education and human resource development (8th ed.). Routledge. https://doi.org/10.4324/9781315816951
6. [6]Mezirow, J. (1991). Transformative dimensions of adult learning. Jossey-Bass.
7. [7]Kolb, D. A. (1984). Experiential learning: Experience as the source of learning and development. Prentice-Hall.
8. [8]Dreyfus, S. E. (2004). The five-stage model of adult skill acquisition. Bulletin of Science, Technology & Society, 24(3), 177-181. https://doi.org/10.1177/0270467604264992
9. [9]Wood, D., Bruner, J. S., & Ross, G. (1976). The role of tutoring in problem solving. Journal of Child Psychology and Psychiatry, 17(2), 89-100. https://doi.org/10.1111/j.1469-7610.1976.tb00381.x
10. [10]Ericsson, K. A., Krampe, R. T., & Tesch-Römer, C. (1993). The role of deliberate practice in the acquisition of expert performance. Psychological Review, 100(3), 363-406. https://doi.org/10.1037/0033-295X.100.3.363
11. [11]Schön, D. A. (1983). The reflective practitioner: How professionals think in action. Basic Books.
12. [12]Spence, M. (1973). Job market signaling. The Quarterly Journal of Economics, 87(3), 355-374. https://doi.org/10.2307/1882010
13. [13]Ashforth, B. E., & Saks, A. M. (1996). Socialization tactics: Longitudinal effects on newcomer adjustment. Academy of Management Journal, 39(1), 149-178. https://doi.org/10.2307/256634
14. [14]Bauer, T. N., Bodner, T., Erdogan, B., Truxillo, D. M., & Tucker, J. S. (2007). Newcomer adjustment during organizational socialization: A meta-analytic review of antecedents, outcomes, and methods. Journal of Applied Psychology, 92(3), 707-721. https://doi.org/10.1037/0021-9010.92.3.707
15. [15]Bureau of Labor Statistics. (2024, May). Occupational Employment and Wage Statistics: Information Security Analysts (15-1212). U.S. Department of Labor. https://www.bls.gov/oes/current/oes151212.htm
16. [16]CyberSeek. (2026). Cybersecurity Supply/Demand Heat Map (Q1 2026 edition). National Initiative for Cybersecurity Education. https://www.cyberseek.org/