The key to learning and teaching new skills lies in a three-step advancement: awareness, training, and development. These steps guide learning new skills, including effective communication, how to build better passwords, and even activities like archery and yoga.

Understanding this advancement allows us to build better communication. To ease the process of change. It’s a construct to build on, to model specific concepts. Each step plays a role in guiding the journey from where we are to where we need to be. By focusing on the needs of individuals, the entire organization advances.

Getting the terms right is the first step in experimenting with and ultimately advancing through each of the phases.


Awareness: the individual realization of the consequences of an action, in their own context of intention and impact. Awareness often leads to action, but the action needs to be guided and supported. 

“Once there is seeing, there must be acting. With mindfulness, we know what to do and what not to do to help.” ~Thich Nhat Hanh

Take passwords, for example. What does awareness of passwords mean? What does it look like?

Start by applying the definition of awareness to the concept of passwords. What is the consequence of selecting and using a password? Or of password reuse? The challenge isn’t the answer to the questions (especially from someone already aware). The problem is the lack of broad, individual understanding of the connection between intention and impact — in context. Instead, people know only that passwords are a pain to endure.

The key to awareness is to create an environment for individual realization.

Present familiar information readily embraced and understood by the audience. Focus on what matters to them. Guide a journey from a decision to an outcome. Allow them to work through the elements. Support the realization of the consequences — based on their intention, and with their impact.

I teach people how to build better passwords by providing a functional overview. No jargon. No math. A whiteboard diagram with boxes, arrows, and a discussion (not a lecture). For many, it’s the first time the information has made sense. It’s finally in context. Like light bulbs going off, people become aware of the consequences of poor passwords.

Awareness does not generally mean individuals have the understanding and experience to take the proper actions. Awareness is the realization. Nothing more. Once aware of the consequences, people often seek a desire to learn. They seek training.


Training: a specific, timed situation to acquire and demonstrate new skills. Training is defined, measurable, and the outcomes demonstrable. 

Training can be formal, informal, scheduled or ad-hoc. Training can take minutes, hours, days or longer. The key is training is the learning of new skills. The result of training is the demonstration of those skills.

Aware of how passwords work, training to build a better password starts with strategies. Participants learn different methods. Armed with information, the key to the training is how they use it. Built using the Information Interaction Model (IIM), people form small teams, plan their strategy and then compete against others.

In a matter of minutes, participants upset about the insanity of 8-character passwords confidently build, share, and explain the methodology to create 32-character passwords. I’ve even had a person come up to me over five years later to recite the password learned on a Tuesday afternoon! They learn, practice, and demonstrate the skills they need to build and use better passwords.

The challenge of training is that the new skills are often shelved in favor of familiar routines when faced with a consistent (read: unchanged) working environment. In other words, just training someone may not lead to lasting change in behavior.


Development: the consistent practice of skills gained in training, exercised for the purpose of improvement. 

Development can be formal or informal (personal, ad-hoc), structured or unstructured, long or short. Development must be adapted to the outcomes. Successful development incorporates a mechanism for measurement, assessment and recording progress.

During development, people gain experience and a deeper understanding of the skills and how to apply them. This often generates new awareness, inspires new (supplemental) training and encourages people to continue to develop their skills.

Effective development provides the right structure to guide individual improvement. Eases the process of change. Keeps development focused on applying the skills. Helps to prevent misunderstanding and bad habits.

The development path for passwords has a lot of options. It often starts as an extended dialogue. Build on newfound knowledge and skills to build better passwords. Talk about password reuse, proper development and operation, handling exceptions, and candid insights about common challenges. Encourage questions. Amplify experiences. Look for experiences to allow people to continue to apply and develop their skills.

Place emphasis on progress over perfection. 

The more the organization supports and promotes development, the more successful the efforts to encourage new behaviors.

Shifting the culture, focusing on individuals

People make up companies. To shift the culture and influence change, use the advancement through awareness, training, and development to target and shift specific, individual behaviors. Address the needs of individuals to advance the organization.

I use these steps for my own learning. I guide clients, audiences, and workshop participants through this advancement. Understanding these three steps creates better outcomes.

Test it out. Let me know how it works. Get stuck, have a breakthrough or want to chat about it? Let’s connect and revive the art of conversation!

About the Author Michael Santarcangelo

The founder of Security Catalyst, Michael develops exceptional leaders and powerful communicators with the security mindset for success.

{"email":"Email address invalid","url":"Website address invalid","required":"Required field missing"}

Don't know where to start?

Check out Security Catalyst Office Hours to meet your peers and celebrate the good, help each other, and figure out your best next step. We meet each Friday… and it’s free to attend.