This idea of football practice and cybersecurity practice came to me via a conversation with one of my co-workers at Verodin, an SE in Texas named Critt Golden. Critt said it very simply in true Texas succinctness, “In football if you don’t practice you don’t win and in cybersecurity if you don’t practice you don’t win.” This concept was apparently brought to Critt’s attention while working in the field with customers to improve their security talent.

If you’re a football coach you wouldn’t tell your team to take a year off, avoid getting on the field and don’t touch a football then ask them to walk into a game with any expectation of success.