Turning cyber incidents into learning
How can news about cyberattacks lead to the knowledge and training you need? Drawing on recent incidents in Japan and updates to CyBOK, this article considers what AI learning assistants could support, and what matters when checking sources and evaluating their effectiveness.
What to learn as incidents increase
A National Police Agency bulletin published in September 2026 states that the agency recorded 123 ransomware incidents in the first half of 2026, the highest figure for a half-year period [1]. This reflects incidents known to the police; it is not a count of every attack or unreported incident in Japan. Domestic incident announcements describe different problems, including business disruption, publication of information, impersonation emails and encryption of shared storage. A single awareness message is unlikely to prepare an organisation for all of them.
Knowledge bases need sources and version information
CyBOK provides a foundation for systematically learning about authentication, networks, human behaviour, risk management and incident management. Its official website explains that version 1.2, released in September 2026, revised two Knowledge Areas: Software Security and Secure Software Lifecycle [2]. A knowledge base using version 1.1 should make that version explicit and compare and assess the revisions separately. The release of a new version does not mean existing translations and learning records must be replaced without review.
Move between incident cases and exercises
Learning support should connect reviewing a case, studying the knowledge it requires, practising in a safe environment and reflecting on the experience within one learning path. For an email compromise, for example, learners can study authentication and human behaviour, then use fictional accounts to practise reporting and response. For recovery, they can study incident management and risk management, then test restored data and decisions about resuming operations. When incorporating exercises from SudoRange or another environment, check that suitable content exists and supplement any gaps with tabletop exercises. There is no need to collect actual leaked information as training material.
AI can support understanding and reflection
AI learning assistants could show the underlying knowledge and relevant references, and adapt explanations and questions to a learner’s role. They could also record decisions that caused uncertainty in an exercise and suggest further study based on gaps in understanding. These are directions for future implementation and evaluation, not claims that prevention of harm or learning benefits have already been demonstrated. Even AI running in a closed environment requires access controls, updates and source verification. We suggest starting by connecting one case with one exercise, then checking the accuracy of explanations and whether learners improve their decision-making.
Test role-based learning on a small scale
The same email compromise case can lead to different learning tasks: independent verification and reporting for users; authentication and session handling for administrators; and customer communication for management. AI could use learners’ answers to suggest what remains unclear and which knowledge to study next. Evaluation should check whether explanations contain unsupported claims, whether sources and referenced versions are correct, and whether learners can explain their decisions under new conditions. The value of Personalised Learning lies not just in faster answers, but in helping learners use the knowledge they need independently.
Next to read
How AI Could Change Cybersecurity Learning — The AI Learning Cyber Hiroshima Is Working Towards
Discover the AI-assisted learning support Cyber Hiroshima is working towards.
How to Learn Cybersecurity Systematically — Using CyBOK as a “Map”
Use Knowledge Areas to locate your learning within the wider field and identify related topics.
References
[1] National Police Agency, Cyber Police Agency Letter 2026, Vol. 16, September 2026 (in Japanese).