Drills: A New Way to Learn

The practice you keep putting off

You meant to practise this week. There was twenty minutes at lunch, ten before a call, a dead half-hour waiting on a deploy. None of it felt like enough to start anything, so you started nothing — and that is a completely reasonable decision every single time you make it.

A lab needs a run-up. You need a clear head, a block of time, and somewhere to put your whole attention for an hour. That is exactly right for what a lab teaches. It is also exactly why it gets moved to the weekend, and then to next weekend.

Skills do not fall off a cliff. They decay over a couple of months of meaning to get back to it.

That was the honest gap on this platform. There was plenty to do with an hour and nothing to do with eleven minutes.

Drills

Pick the topics you want, pick how hard, and answer questions against a clock. You get the explanation the moment you answer, whether you got it or not. Thirteen topics, one hundred questions each — networking, operating systems and Linux, SQL, scripting, general security fundamentals, and the eight defensive disciplines from security operations and detection engineering through to incident response and code review.

The clock is the part that makes it practice rather than reading. With the answer in front of you, your brain tells you that you know this. With fifteen seconds and no page to look at, you find out.

One minute, five, or an afternoon

The point of building it this way is that the time you have stops being a reason not to.

A minute

The Daily Signal is one question. One attempt, no second go, and it is gone at midnight. It costs you the time you would spend deciding whether to bother, and it is the one that compounds — because the habit you can keep on a bad day is the only habit that survives a bad month.

Five minutes

A ten-question drill on whatever you choose. One topic if you are shoring something up, several if you want to be kept honest. The clock scales with the difficulty — fifteen seconds, twenty, thirty — because a judgement call in a live situation deserves longer than a port number does.

An afternoon

Twenty questions, every tier, as many topics as you can stand, and then again. Or wait for Tuesday: The Gauntlet gives everyone the same ten questions, and the board ranks on how quickly you got through them.

Nothing to set up

This is the part that usually decides whether practice happens. Working on detection or hunting normally means standing something up first — a virtual machine, a log shipper, sample data that looks enough like the real thing — and the evening is gone before the first question. Drills need a phone and a spare minute.

And what you build here moves with you. The SQL is a defender's SQL: reading a join during an investigation, aggregating a log, spotting an injection pattern and knowing which defence actually stops it. That carries over to KQL, to SPL, to whatever your next employer happens to have bought. The menu layout of one vendor's console carries over nowhere.

Where to start

Open Drills, pick the topic you are most confident about, and set it to ten questions. It is included with a membership, with nothing extra to buy. If you do not have an account yet, grab a seat and start with the topic you would put on your CV.

Fair warning: the first run will go worse than you expect, and that is the whole value of it. The questions you miss are the ones you thought you had.

The clear hour was never going to arrive. The minute you have right now will do.