Joanna Duffy - TryHackMe Blog

Sign in Subscribe

Joanna Duffy

Cyber leaders, don't measure what you've built. Measure what you can do under pressure.

Sooner or later , the question arrives, usually from the people an organization least wants to improvise in front of such as the auditor, the insurer, the regulator, the board: can your team execute under pressure?

Incident Response training for security teams: What good actually looks like

When it comes to cybersecurity training, three things tend to separate the solutions with actual impact from what just looks good on paper: realism, hands-on practice, and a genuine feedback loop.

Is your security team AI ready? What genuine AI capability looks like

Teams are being asked to protect systems they do not understand end to end, so what usually gets deployed in response is a patchwork of small, disconnected controls rather than a coherent framework built around an actual understanding of the risk

Cybersecurity certifications for teams: How to build a program around Security Analyst Level 1 and 2

The majority of widely recognized security certifications were designed for individual career development, and are detached from the needs of hiring organizations. This creates a specific problem for managers trying to build an actionable understanding of team readiness.

Blue team training for SOC teams: How to move from individual skills to team readiness

A team of individually strong analysts who have never practiced responding together is not a ready team. It's a collection of capable individuals who haven't become an operational unit.

What is a cyber range? The answer has changed.

The cyber range market has productized significantly. But across the board, the market doesn't accommodate most security teams, and forces a compromise on the thing that matters most: continuous improvement.

Cybersecurity training for UK security teams: what enterprise buyers need to know

Before a platform reaches your analysts, it has to clear procurement, satisfy InfoSec, pass legal review, and in many organisations survive a finance sign-off that nobody budgeted for. For UK security teams, that process carries specific requirements.

What is DFIR? Digital Forensics and Incident Response Explained

DFIR combines two distinct specializations: digital forensics and incident response. These disciplines are deeply related, occasionally in tension, and together form the backbone of how organizations understand and survive a serious security breach.

Tabletop templates are not the answer for small security teams

Tabletop exercise templates give small security teams a false sense of readiness. They're generic by design, require a human facilitator to run well, and can't adapt to your stack, your threat landscape, or the way your team actually makes decisions under pressure.

How does a top German bank manage cyber readiness?

DZ BANK AG is Germany's second-largest bank. It’s a central institution to around 800 cooperative banks, and a core part of the financial infrastructure that millions of people and businesses across Germany rely on. It goes without saying that the cyber security team protecting it needs to be sharp,

AI risk doesn't care what your job title is

As we were creating our new AI security path, we spoke to leaders across healthcare, finance, automotive, manufacturing and insurance to understand what they were most worried about, and where we could help.

5 Things We Learned About Optimizing SOC Onboarding

Earlier this week, TryHackMe content engineers Niels Deryckere and Gabriel Novaes sat down with Head of Content Engineering, Marta Strzelec to talk about one of the most overlooked problems in security operations: effective onboarding. Here's what came out of that conversation.

What’s more valuable: spotting a breach or explaining why it matters?

What’s more valuable: spotting a breach or explaining why it matters?

The ability to explain what’s happening in the right language for the right audiences within and outside the SOC determines whether security work has any impact at all.

Bad SOC onboarding is frustrating. It’s also expensive.

Every day a new SOC analyst isn't fully operational is a day your coverage has a gap. Multiply that by 11–13 months and you're looking at a business risk. Many great teams are quietly carrying this risk without anyone estimating its true material impact.

Mid-senior SOC practitioners deserve better than a certificate of attendance

You know your SOC team is good. How do you objectively prove it to the wider business?

7 lessons for building cyber security allies: a chat with SSAB’s Eric Andresen

We spoke to Eric Andresen, Senior Manager of Information Security at SSAB, about how he built an internal network of engaged business leaders who serve as "force multipliers" for cybersecurity

Training? Do you mean culture shift? A spotlight on ARAG IT

Training? Do you mean culture shift? A spotlight on ARAG IT

What happens when cybersecurity training becomes structured, measurable, and aligned to real roles? ARAG IT shows how a fragmented approach can evolve into a program that drives both skills and culture.

You Can Govern AI Without Killing Coding Velocity: Key Takeaways From Our Live Session

You Can Govern AI Without Killing Coding Velocity: Key Takeaways From Our Live Session

Last week we hosted a webinar on a challenge many cybersecurity leaders are facing: governing AI in development. AI tools are unavoidable, but the answer isn’t bans or a free-for-all. The key is practical governance that engages teams beyond the SOC.

Beware the Complacent Training Platform

Cybersecurity training can't afford complacency. Here’s how to spot when a platform is coasting on reputation instead of actually building capability.

In FinServ, Compliance Can’t Replace Capability

Now that the compliance deadlines have passed, SOC teams in Financial Services are being asked more challenging questions about their team’s real capability.

What If "Awareness" Had True Substance?

Cyber Security Awareness Month often becomes another email, another module, another forgotten video. A Capture the Flag event changes that. Instead of telling people about security, it lets them experience it. The result is real buy-in, stronger teams, and awareness that actually lasts.