The prepared environment¶

In Montessori practice, the environment is not neutral. It is designed to make certain kinds of engagement possible and to reduce the friction that prevents them. For adults learning security work, this means thinking carefully about what the physical and digital spaces make easy, what they make difficult, and what they make invisible.

What preparation means in practice¶

An unprepared environment for security learning looks like this: a training module in an LMS that takes forty minutes, covers twelve concepts, and ends with a quiz. The learner has no context for why the concepts matter, no opportunity to test them against anything real, and no way to go deeper on the one thing that actually interested them. The environment has shaped a particular kind of experience, and it is not a useful one.

A prepared environment for security learning looks different. The challenges are accessible without requiring setup. The sandboxed lab is already running. The relevant documentation is findable. The tooling is installed. The exercise has a clear entry point and an open-ended middle. Someone more experienced is nearby but not hovering. There is space to fail without consequence and try again.

The difference is not primarily about resources. It is about intentional design.

Physical space¶

Physical environments for security learning benefit from the same principles that apply to any focused technical work: good light, minimal interruption, surfaces for spread-out thinking, and proximity to other people who are doing the same kind of work.

Cluster or circle arrangements work better than rows for collaborative reflection. Reference materials on walls or whiteboards work better than buried in shared drives. Access to physical tools for diagramming, annotation, and working through problems spatially supports the kind of thinking that security work requires and that screens alone do not accommodate well.

Digital space¶

Digital environments need the same intentionality. A sandboxed lab that takes thirty minutes to stand up will not be used for spontaneous exploration. A reference library that requires navigating three menus will not be consulted at the moment of need. A set of exercises that requires root access and a specific OS configuration will be attempted once and abandoned.

The prepared digital environment has:

• Labs that start in a known, clean state and can be reset without ceremony.

• Exercises that are structured in layers: a clear starting point, optional depth, and extension paths for those who want to go further.

• Reference materials adjacent to the exercises they support.

• Clear boundaries around what is safe to try and what requires supervision.

The environment shapes behaviour¶

This is the core Montessori insight and it applies directly to the Satir and ChangeShop observations about system behaviour. If the environment makes the unsafe path easier than the safe one, people will take the unsafe path, not because they have made a deliberate choice but because they are following the grain of the environment.

A security team that works in an environment where raising a concern is more effortful than ignoring it will ignore concerns. A learner who works in an environment where going deep on an interesting problem requires navigating bureaucratic approval will not go deep. The environment is not a backdrop. It is a determinant of what happens.

Preparing the environment is not a one-time task. As the threat landscape changes, as the team’s capability develops, and as frictions are discovered in practice, the environment needs to be adjusted. The role of the facilitator is partly to observe what the environment is producing and to change it when it is producing the wrong things.