How to Cross-Train IT Staff into Cybersecurity: A Role-by-Role Plan (Including IT Managers)
To cross-train IT staff into cybersecurity, map each IT role to the security skills it is closest to, then combine four things over about 12 weeks: free foundation learning (Cisco Networking Academy, Microsoft Learn, IBM SkillsBuild), one certification where it helps (usually CompTIA Security+, US$439 as of October 2026), hands-on labs, and real exposure through SOC shadowing or an incident rotation. Help desk staff move toward SOC triage, sysadmins toward hardening and detection, network engineers toward network defence, cloud and DevOps staff toward cloud security, and developers toward application security. IT managers are the gap most programmes miss: they need risk, governance, incident command and metrics, which suits decision simulations and tabletop exercises more than technical labs.
Cross-training works because IT staff already know your systems, your users and your change process: the things an external hire takes months to learn. What they lack is the attacker’s view and the habits of security work. This plan fills that gap role by role, with costs as of October 2026.
Why cross-train instead of hiring?
CyberSeek’s US data (May 2024 to April 2025) shows a supply-to-demand ratio of 74%: roughly 74 qualified workers for every 100 cybersecurity job openings. Hiring is slow and senior candidates are expensive. Your IT team is the closest pool of people who already understand the environment. The trade-off is time: expect about 12 weeks to a working foundation and 6 to 12 months of supervised work before someone handles incidents on their own.
Which security skills should each IT role add?
Start from what each role already knows. The bottom row is the one most cross-training guides leave out.
| Current role | Security skills to add | Free resources | Certification option (Oct 2026) | Hands-on practice |
|---|---|---|---|---|
| Help desk / IT support | Alert triage, phishing analysis, identity and MFA basics, ticket writing | Cisco Junior Cybersecurity Analyst path; LetsDefend free plan | CompTIA Security+ (US$439) or ISC2 CC (US$199) | SOC Log Triage Trainer, Email Authentication Lab |
| Sysadmin | Hardening, Windows and Linux logging, privilege and patch management, detection | Microsoft Learn SC-200 path; CIS Benchmarks | Security+ then CySA+ (US$439) | Detection Lab, Kerberos Attack Lab |
| Network engineer | Segmentation, firewall policy, egress control, packet analysis, VPN and edge threats | Cisco Networking Academy; Wireshark documentation | Cisco CCST Cybersecurity (US$125) or CyberOps Associate (US$300) | Firewall Rule Lab, Egress Proxy Lab |
| Cloud / DevOps | Cloud IAM, logging, posture management, secrets, CI/CD security | AWS Skill Builder security learning plan; Wiz CloudSec Academy | AWS Certified Security – Specialty (US$300) | Cloud Posture Lab, IAM Privilege Escalation Lab |
| Developer | Secure coding, OWASP Top 10, authentication and tokens, dependency risk | PortSwigger Web Security Academy; OWASP Top 10 | Often none needed; PortSwigger’s own certification if wanted | JWT Lab, npm package scanner |
| IT manager | Risk and governance, incident command and escalation, executive communication, security metrics | NIST CSF 2.0; UK NCSC Board Toolkit; CISA Tabletop Exercise Packages | Later: ISACA CISM (needs security management experience) | Cyber War Room, Tabletop Facilitation Lab, Risk Register, KPI library |
All free resources above are listed, with what is and is not free, in the PlayCISO learning library.
What does a 12-week cross-training plan look like?
About 5 hours a week of protected time per person, agreed with their manager in writing:
- Weeks 1 to 4, foundation. A free foundation course (Cisco, IBM SkillsBuild or Microsoft Learn SC-900 path) and one browser lab a week. Goal: shared vocabulary and the confidence to read an alert.
- Weeks 5 to 8, role labs and shadowing. Labs from the role row above, plus two half-days shadowing the SOC or your managed security provider. Each person writes up one alert they followed from start to finish.
- Weeks 9 to 12, a real task and an exam. One supervised security task in their own area (harden a server baseline, review firewall rules, fix a cloud misconfiguration) and the certification exam if the role plan includes one.
- After week 12, rotation. A recurring slot in the incident or on-call rotation as second responder, with a named mentor.
How do you cross-train IT managers?
IT managers do not need to hunt threats. They need to make good decisions when one is found: when to declare an incident, who to call, what to tell executives, which risks to accept and how to show progress. Technical labs do not teach that. Practice that does:
- Incident command: the Cyber War Room puts them in charge of a branching incident at a fictional company and scores the decisions.
- Running exercises: the Tabletop Facilitation Lab teaches them to run a tabletop for their own team.
- Plans and roles: the Incident Response Plan Builder and RACI Builder.
- Risk and metrics: the Risk Register, the Board Metrics Lab and the KPI library (30 security roles, 5 KPIs each).
How do the main training options compare for cross-training?
| Option | Best for | Why | Main drawback | Cost profile |
|---|---|---|---|---|
| Free vendor academies (Cisco, Microsoft Learn, AWS Skill Builder, IBM SkillsBuild) | Foundations and badges | Free, structured, recognised names | Little hands-on depth; vendor-flavoured | Free; exams paid |
| Hands-on lab platforms (TryHackMe, Hack The Box) | Technical staff who learn by doing | Large libraries, full virtual machines, team plans | Mostly technical; less for managers | Free tiers; paid individual and business plans |
| SANS training | Senior specialists | Depth, GIAC alignment | Very expensive per seat | Thousands of US dollars per course |
| Certification-first (Security+, CySA+) | Getting a recognised baseline | Clear goal and recognised outcome | Passing is not the same as doing | US$439 per CompTIA voucher |
| PlayCISO | Browser labs for analysts and decision simulations for IT managers | 139 browser labs, War Room incident simulations, KPI library; no install | No full VM attack boxes, no accredited certification, no LMS/SCORM integration; smaller library than TryHackMe or Hack The Box | Free to start; Pro US$5/month or US$40/year |
How do you measure whether cross-training worked?
- Lab scores at week 4 and week 12 on the same lab.
- Supervised security tasks completed, and how many needed rework.
- Time for a cross-trained person to triage a standard alert, compared with the SOC baseline.
- Certification pass rate on the first attempt.
- Retention after 12 months: cross-trained people who stay are the return on the programme.
Checklist: launching a cross-training cohort
- Pick 3 to 6 people and map each to a row in the role table.
- Agree 5 protected hours a week with their managers, in writing.
- Give each a written plan; the Cyber Certification Roadmap produces one to copy.
- Name a mentor in the security team for each person.
- Book SOC shadowing slots for weeks 5 to 8.
- Budget one exam voucher per person who needs a certification.
- Schedule a tabletop exercise in week 12 that includes the IT managers.
Frequently asked questions
What should I use to cross-train IT staff into cybersecurity?
A mix: free foundation courses (Cisco Networking Academy, Microsoft Learn, IBM SkillsBuild), one recognised certification such as CompTIA Security+, hands-on labs matched to each person’s current role, and real exposure through SOC shadowing or an incident rotation. Measure progress with lab scores and on-the-job tasks, not course completions.
How long does it take to cross-train an IT person into security?
About 12 weeks part-time for a working foundation and first certification if they already work in IT, then 6 to 12 months of supervised work before they handle incidents alone. Help desk and sysadmin staff usually move fastest because they already know users, endpoints and logs.
How do you train IT managers in cybersecurity?
Focus on decisions rather than tools: risk registers and risk appetite, incident command and escalation, communications with executives, and security metrics. Tabletop exercises and branching incident simulations work better than technical labs. A management certification such as CISM is a later step once they have security management experience.
Is it cheaper to cross-train IT staff than to hire security people?
Usually, for junior and mid-level roles. A Security+ voucher is US$439 and many good resources are free, while CyberSeek’s US data shows only 74 certified or qualified workers for every 100 cybersecurity openings, which keeps external hiring slow and expensive. Senior specialist roles are still often a hire.
Ready to practise the decisions these articles describe?
Run your first War Room free →One run free with a free account · more runs with Pro