Reflection and feedback loops¶

Practice without reflection produces habit rather than understanding. A team that runs the same incident response exercise repeatedly without examining what they did and why will get faster at the exercise without becoming more capable at handling incidents that do not fit the exercise’s template.

Reflection is the mechanism that converts experience into learning. Without it, the hands-on work produces muscle memory for specific scenarios. With it, the same work produces a developing model of how systems behave, what attackers do, and how defences work or fail.

What reflection looks like in practice¶

Reflection after an exercise is not a debrief where the facilitator explains what the correct approach was. It is a structured conversation that starts from what the participants actually did and experienced.

Useful starting questions: what were you assuming at the start of this that turned out to be wrong? Where did you get stuck and what got you unstuck? What would you look for first if you saw this pattern in a real environment? What would you do differently if you had to run through this again?

The goal is to surface the mental model the participant was working from and to examine it against what the exercise revealed. This is SEM applied to learning: the exercise is producing evidence about the model’s accuracy, and the reflection is the process of updating the model based on that evidence.

Journalling and documentation¶

Writing is a reflection tool. Asking participants to maintain a log of what they did, what they noticed, and what questions the exercise raised is not bureaucratic overhead. It is a practice that produces two things: a record that can be reviewed and discussed, and the habit of attending to one’s own thinking rather than just to the output.

The format can be minimal. A few sentences after each exercise session, noting what was unexpected, what connected to something from a previous session, and what remains unclear. Over time this creates a visible record of developing understanding, which is informative both for the participant and for the facilitator.

Peer review¶

Some of the most useful reflection happens between peers rather than between learner and facilitator. Two people who have approached the same exercise differently have access to each other’s reasoning in a way that individual reflection cannot produce.

Structured peer review of approaches, detection strategies, or proposed mitigations surfaces assumptions that neither participant would have examined alone. It also distributes knowledge across the team in a way that makes the team’s overall capability less dependent on any single person’s presence.

Connecting to operational reality¶

Reflection is most durable when it is connected to real conditions. After a simulated lateral movement exercise, the useful question is not only “what did we detect in the simulation?” but also “what would this look like in our actual environment, and what would we actually see in our logs?”

This connection requires the facilitator to bring knowledge of the real environment into the reflection, and it requires that the simulated environment be close enough to the real one for the comparison to be meaningful. Where there are significant gaps between the simulated and real environments, those gaps are themselves worth examining: they may reveal assumptions about the real environment that have not been tested.

Feedback into the programme¶

Reflection generates feedback not only for individual learners but for the learning programme itself. Patterns in what participants are consistently getting wrong, consistently finding too easy, or consistently finding difficult to transfer to their actual work are signals that the exercises need to change.

This closes the loop between the prepared environment and the learning that happens in it. The environment is designed, the learning happens, the reflection surfaces what the design produced, and the environment is adjusted. The programme improves not through a periodic curriculum review but through continuous observation and adjustment – which is the Montessori method applied to the programme as a whole rather than to individual learners.