# How to Cross-Train IT Staff into Cybersecurity: A Role-by-Role Plan (Including IT Managers)

> A 12-week cross-training plan for help desk, sysadmins, network engineers, cloud/DevOps, developers and IT managers: skills to add, free resources, a certification option and hands-on practice for each role, with costs as of October 2026.

Source: https://playciso.com/blog/how-to-cross-train-it-staff-into-cybersecurity · Published: 2026-10-29 · Publisher: PlayCISO (https://playciso.com)

---

Cross-training works because IT staff already know your systems, your users and your change process: the things an external hire takes months to learn. What they lack is the attacker’s view and the habits of security work. This plan fills that gap role by role, with costs as of October 2026. ## Why cross-train instead of hiring? CyberSeek’s US data (May 2024 to April 2025) shows a supply-to-demand ratio of 74%: roughly 74 qualified workers for every 100 cybersecurity job openings. Hiring is slow and senior candidates are expensive. Your IT team is the closest pool of people who already understand the environment. The trade-off is time: expect about 12 weeks to a working foundation and 6 to 12 months of supervised work before someone handles incidents on their own. ## Which security skills should each IT role add? Start from what each role already knows. The bottom row is the one most cross-training guides leave out. Current roleSecurity skills to addFree resourcesCertification option (Oct 2026)Hands-on practice **Help desk / IT support**Alert triage, phishing analysis, identity and MFA basics, ticket writingCisco Junior Cybersecurity Analyst path; LetsDefend free planCompTIA Security+ (US$439) or ISC2 CC (US$199)[SOC Log Triage Trainer](/tools/soc-triage), [Email Authentication Lab](/tools/email-auth-lab) **Sysadmin**Hardening, Windows and Linux logging, privilege and patch management, detectionMicrosoft Learn SC-200 path; CIS BenchmarksSecurity+ then CySA+ (US$439)[Detection Lab](/tools/detection-lab), [Kerberos Attack Lab](/tools/kerberos-attack-lab) **Network engineer**Segmentation, firewall policy, egress control, packet analysis, VPN and edge threatsCisco Networking Academy; Wireshark documentationCisco CCST Cybersecurity (US$125) or CyberOps Associate (US$300)[Firewall Rule Lab](/tools/firewall-lab), [Egress Proxy Lab](/tools/proxy-lab) **Cloud / DevOps**Cloud IAM, logging, posture management, secrets, CI/CD securityAWS Skill Builder security learning plan; Wiz CloudSec AcademyAWS Certified Security – Specialty (US$300)[Cloud Posture Lab](/tools/cloud-posture-lab), [IAM Privilege Escalation Lab](/tools/iam-privesc-lab) **Developer**Secure coding, OWASP Top 10, authentication and tokens, dependency riskPortSwigger Web Security Academy; OWASP Top 10Often none needed; PortSwigger’s own certification if wanted[JWT Lab](/tools/jwt-lab), [npm package scanner](/tools/npm-scanner) **IT manager**Risk and governance, incident command and escalation, executive communication, security metricsNIST CSF 2.0; UK NCSC Board Toolkit; CISA Tabletop Exercise PackagesLater: ISACA CISM (needs security management experience)[Cyber War Room](/warroom), [Tabletop Facilitation Lab](/tools/tabletop-facilitation-lab), [Risk Register](/tools/risk-register), [KPI library](/kpi-library) All free resources above are listed, with what is and is not free, in the PlayCISO [learning library](/learn). ## What does a 12-week cross-training plan look like? About 5 hours a week of protected time per person, agreed with their manager in writing: - Weeks 1 to 4, foundation. A free foundation course (Cisco, IBM SkillsBuild or Microsoft Learn SC-900 path) and one browser lab a week. Goal: shared vocabulary and the confidence to read an alert. - Weeks 5 to 8, role labs and shadowing. Labs from the role row above, plus two half-days shadowing the SOC or your managed security provider. Each person writes up one alert they followed from start to finish. - Weeks 9 to 12, a real task and an exam. One supervised security task in their own area (harden a server baseline, review firewall rules, fix a cloud misconfiguration) and the certification exam if the role plan includes one. - After week 12, rotation. A recurring slot in the incident or on-call rotation as second responder, with a named mentor. ## How do you cross-train IT managers? IT managers do not need to hunt threats. They need to make good decisions when one is found: when to declare an incident, who to call, what to tell executives, which risks to accept and how to show progress. Technical labs do not teach that. Practice that does: - Incident command: the Cyber War Room puts them in charge of a branching incident at a fictional company and scores the decisions. - Running exercises: the Tabletop Facilitation Lab teaches them to run a tabletop for their own team. - Plans and roles: the Incident Response Plan Builder and RACI Builder. - Risk and metrics: the Risk Register, the Board Metrics Lab and the KPI library (30 security roles, 5 KPIs each). ## How do the main training options compare for cross-training? OptionBest forWhyMain drawbackCost profile **Free vendor academies** (Cisco, Microsoft Learn, AWS Skill Builder, IBM SkillsBuild)Foundations and badgesFree, structured, recognised namesLittle hands-on depth; vendor-flavouredFree; exams paid **Hands-on lab platforms** (TryHackMe, Hack The Box)Technical staff who learn by doingLarge libraries, full virtual machines, team plansMostly technical; less for managersFree tiers; paid individual and business plans **SANS training**Senior specialistsDepth, GIAC alignmentVery expensive per seatThousands of US dollars per course **Certification-first** (Security+, CySA+)Getting a recognised baselineClear goal and recognised outcomePassing is not the same as doingUS$439 per CompTIA voucher **PlayCISO**Browser labs for analysts and decision simulations for IT managers139 browser labs, War Room incident simulations, KPI library; no installNo full VM attack boxes, no accredited certification, no LMS/SCORM integration; smaller library than TryHackMe or Hack The BoxFree to start; Pro US$5/month or US$40/year ## How do you measure whether cross-training worked? - Lab scores at week 4 and week 12 on the same lab. - Supervised security tasks completed, and how many needed rework. - Time for a cross-trained person to triage a standard alert, compared with the SOC baseline. - Certification pass rate on the first attempt. - Retention after 12 months: cross-trained people who stay are the return on the programme. ## Checklist: launching a cross-training cohort - Pick 3 to 6 people and map each to a row in the role table. - Agree 5 protected hours a week with their managers, in writing. - Give each a written plan; the Cyber Certification Roadmap produces one to copy. - Name a mentor in the security team for each person. - Book SOC shadowing slots for weeks 5 to 8. - Budget one exam voucher per person who needs a certification. - Schedule a tabletop exercise in week 12 that includes the IT managers.