Why training alone won’t produce a capable cyber investigator

Editor’s note: This is the third article in a series on building an effective cyber investigations unit. In Part 1, Sgt. Peter Hish examines the foundational decisions agencies must make before launching a unit. Part 2 explores how to select the right investigators. This installment focuses on training and why the person receiving it matters as much as the courses themselves.

By Sergeant Peter Hish

Your new cyber investigator has attended every course on the list. The certificates hang framed. It is month nine, and they still cannot carry a case from intake to filing without someone standing behind them.

This happens in good agencies, to good chiefs who did everything the budget asked of them. It happens because of an assumption buried so deeply in how we plan that almost nobody says it out loud: that training produces a cyber investigator. It does not. Training amplifies one. The gap between those two sentences is a year of salary, a year of a senior investigator’s attention and whether the unit you funded can actually work a case.

Training does not create the interest

Cyber competence is not a skill set that transfers cleanly from a classroom to an investigator. It is a body of knowledge that keeps shifting, and the people who stay current with it are the people who were already tracking it before anyone sent them anywhere.

That is the part agencies do not plan for. An investigator who is genuinely invested in cyber and security generally comes to the first course already holding context. They have read about the breach that is in the news. They have a home lab, or a hobby, or an opinion about a protocol. When the instructor covers something in forty minutes, it lands on ground that was already prepared, and the investigator keeps pulling on it after the class ends.

An investigator without that interest sits through the same forty minutes and retains what anyone retains from a lecture on an unfamiliar subject, which is not much and which decays. Send that same person to four more courses, and you have four more decayed foundations and a transcript.

This is not a knock on good investigators. It is the same point the staffing article made from the other direction. That piece argued that selection has to screen for aptitude and not just interest. This one argues the reverse is equally true. Training alone is not enough either. You need both, and the pipeline substitutes for neither.

The year, and what compounds inside it

Ask what it actually takes to get a new assignee to independent casework, and the honest answer is about twelve months, sequenced roughly like this.

The first three months are foundations. The federal providers carry most of this, and they are the reason a small agency can build this capability at all. The National White Collar Crime Center, the National Computer Forensics Institute and the FBI’s investigative training give a new investigator the vocabulary and the legal footing to be useful.

Months four through six are supervised casework. The investigator sits second chair on real cases with a senior investigator who is deliberately giving up throughput to teach. This is the part agencies skip when the caseload is heavy, and skipping it is why month nine arrives with nobody ready.

Months seven through twelve are specialization and a first owned case. Cryptocurrency tracing, open-source collection, cloud evidence, mobile forensics. Which one depends entirely on what your agency actually sees, not on what sounds interesting.

That order cannot be compressed, and the reason is instructive. A cryptocurrency tracing course lands on nothing until the investigator has worked a case where the money moved and felt the specific frustration the course resolves. Send them in month two, and you have spent the money twice, because you will send them again.

Here is what the roadmap does not say on paper. Those twelve months are identical for both investigators. Same courses, same travel, same cost. In the one who was already invested, each course compounds on the last. In the one who was not, each course is a separate event that fades before the next one starts. The roadmap is not the variable. The person is.

What the training budget actually buys

The foundational federal training is largely free, and that fools the people who write budgets into thinking the pipeline is cheap. The tuition line is the smallest part of what this costs.

What it actually costs is the seat sitting empty while your investigator travels, the months spent waiting for a class to open, and a senior investigator giving up part of a caseload for a year to supervise someone else’s development. That last one is the real expenditure, and it never appears in a budget request.

Certifications deserve the same scrutiny. Some of them buy you something concrete. The SANS GIAC forensic credentials, the EnCase Certified Examiner and the Certified Forensic Computer Examiner through IACIS carry weight because a defense attorney will ask about them, and the answer matters. Others are a line on a resume. Before funding one, ask what it lets the unit do that it cannot do today, and whether it will hold up when someone cross-examines the examiner who holds it.

One distinction worth protecting here: Civilians belong in the analytical craft, where the work is open-source collection, link analysis, and blockchain tracing. The case-building and forensic work stays sworn, because both run through search warrants, evidence handling, chain of custody, and testimony. A certification discussion has a way of quietly erasing that line. Do not let it.

The thing your selection process cannot see

Here is the uncomfortable part, and it is the reason this belongs in a leadership conversation rather than a technical one.

Your selection process cannot detect any of what I just described. A competitive examination measures what it was built to measure, and nothing in it reveals whether a candidate goes home and reads about this. There is no question on a ranked list that surfaces a home lab. So the process hands a chief a name, the chief is told to train that name, and the one variable that determines whether the year produces an investigator is invisible to the entire machine.

I watched this work in my own department. The best cyber investigator I have does not hold a college degree, and nothing in their background points to computer science. They grew up around the technology and owned a computer in the 1980s, back when owning one meant you learned how it worked or it did very little for you. Everything after that came from trial and error, a mind that wants to take the thing apart, and enough tolerance for being wrong to stay with a problem. They have been through a stack of formal courses since, some the department paid for and some they paid for themselves.

Ask me why they are good at this, and the honest answer is not a course title. They enjoy the subject.

I want to be careful with that sentence, because it sounds soft and it is not. The training landed because there was somewhere for it to land. Those same courses, given to someone who was assigned the seat and had no particular interest in the work, produce a certificate and not much else. I have watched both outcomes inside the same unit, from the same instructors, in the same budget year.

Now look at what the selection process saw. No degree and no technical credential at the time, in a file that reads like everyone else’s. The one fact that actually predicted the outcome, that this person was already doing the work on their own before anybody paid them to, appears nowhere on a ranked list. It was never invisible. It was just never anything the process asked anyone to look at.

So what can a chief actually do inside a process that offers no latitude?

Look for the evidence that already exists before anyone is selected. It is not hidden. It is the investigator who asks to sit in on a forensic exam, who brings you an article nobody assigned, whose supplemental reports already show they pulled more off a device than anyone asked them to. That person told you what they are interested in without being asked, and that signal is available to you whether or not your process is built to read it.

Then feed it instead of rationing it. If you have identified someone with the interest, the training budget you were going to spread evenly is better spent concentrated.

What a real training plan has in writing at month twelve

You can tell a real training plan from a hopeful one by what exists on paper at the one-year mark.

There is a named roadmap for each investigator, not a list of courses the unit has access to. Travel and backfill are budgeted, so training is not the first thing cut when the caseload spikes. A supervising investigator is assigned by name, with an acknowledgment that their own output drops while they teach. Recurring training is scheduled for the tools the unit depends on, because tool skills expire quietly. A successor is already in the pipeline, because the investigator you trained is now a marketable private-sector hire.

And one more, the one that matters most and appears in the fewest plans. The unit can say which of its people are already doing this on their own time. If nobody can answer that question, the plan is a purchase order, not a training plan.

None of this requires a bigger budget than the agency already approved. It requires accepting that a chief cannot buy competence. You can buy courses, seats, and certifications. What you are actually buying is a year of a senior investigator’s attention pointed at one person, and what you get back depends on who that person was before you spent anything.

About the author

Sergeant Peter Hish is a 27-year veteran of the Los Angeles County Sheriff’s Department, where he has supervised its cyber and fraud team for the past decade. He built the unit he describes in this article and now teaches the same material to incoming command staff through the National Public Safety Innovation Academy at Polk State College and the Regional Training Center in Fountain Valley. A U.S. Army veteran, he is the founder of Sentinel Vault, publisher of the Sentinel Vault Insights blog, and author of “Hacked or Hardened? The New Reality for Business Owners.”