Praxis

In the spring of 1963, in a town called Angicos in the Brazilian northeast, some 300 sugarcane workers learned to read and write in about 45 days. Their teacher was a lawyer-turned-educator from Recife named Paulo Freire, and his method contained no primers about generic children and their generic dogs. The workers learned from words drawn out of their own working lives, and in learning to read the words, they were invited to read the situation the words described. The president of Brazil attended the closing class. Thirteen months later the military seized the government, and one of its early acts was to jail Freire for 70 days, after which he spent sixteen years in exile writing about why education frightens people in charge. A literacy campaign for cane cutters may seem far from a security operations center. Stay with it. The man produced the most useful vocabulary anyone has built for the difference between studying a field and learning one, and this field has never had more need of the distinction.

Freire's most famous chapter, the second of Pedagogy of the Oppressed, describes what he called the banking concept of education: "Education thus becomes an act of depositing, in which the students are the depositories and the teacher is the depositor." The teacher narrates, the student receives, files, and repeats. Sunday's edition borrowed the image for the certification economy, and the fit is uncomfortably good. Content libraries measured in hours. Exam guides organized around recall. Completion certificates that certify completion. The transaction works for the vendor, who counts enrollment, and flatters the learner, who counts hours, and it can proceed indefinitely without anyone establishing whether the learner can do anything afterward that they could not do before.

His alternative he called problem-posing education. Learners confront problems drawn from their own situation, and in working the problems they change both the situation and themselves; teacher and student investigate together. In problem-posing education, he wrote, "people develop their power to perceive critically the way they exist in the world with which and in which they find themselves." The word he used for the engine of it, borrowed from an older philosophical lineage and sharpened, was "praxis": "reflection and action upon the world in order to transform it." Praxis is a loop with two halves, and both halves count. Action without reflection is the home lab torn down at midnight and never written up, the CTF finished and forgotten by Thursday, the incident closed with a ticket note instead of a postmortem. Reflection without action is the course certificate. The loop, run whole, is how a practitioner turns hours into skill.

Before the scholarship, give the LinkedIn-native version its due, because it is closer to Freire than either party would suspect. Alex Hormozi, whose business advice reaches more early-career technologists than any education journal, tells audiences to spend their excess money and hours acquiring skills, on the argument that skills survive any market. In one talk he traces the compounding: rhythm alone earns little, rapping earns more, writing earns more still, and by the time selling and promotion are stacked on top, the same person commands a different economy; his shorthand in the same talk is that skills are inflation-proof. His prescription for acquiring them is volume. "Volume negates luck," runs the line his followers quote, and the gym-owner arithmetic behind it says that enough repetitions make skill inevitable. Half of that survives contact with the evidence. The interesting half is which half.

The scientific version of learning-by-doing is deliberate practice, defined by K. Anders Ericsson and colleagues in a 1993 Psychological Review article built on studies of Berlin conservatory violinists. The best violinists had accumulated about 7,410 hours of solitary practice by age eighteen against 5,301 for the good, and the paper's real contribution was its definition of what those hours contained: activities designed, often by a coach, to target the learner's current weaknesses, executed with full effort, monitored, and corrected with immediate feedback. The recipe is effortful, aimed at the edge of ability, and feedback-rich, which is to say, unpleasant. Malcolm Gladwell flattened the paper into the 10,000-hour rule, a gloss Ericsson spent years disputing, and the correction arrived on schedule. A 2014 meta-analysis by Brooke Macnamara, David Hambrick, and Frederick Oswald aggregated 88 studies and found deliberate practice explaining about 12 percent of performance variance overall, and in professions, the category that contains this one, under 1 percent, a result indistinguishable from zero. A 2019 preregistered replication of the violinist study weakened the original finding further: the best and the good violinists reported statistically indistinguishable practice totals. Ericsson replied that the meta-analysis had counted activities that fail his definition, logged hours of any kind rather than designed practice, and the argument continues in the journals.

Read as a whole, the literature lands somewhere useful for a working professional. Hour counts are a weak currency; the profession's data says logging time predicts almost nothing. The structure of the loop is what carries the freight: real problems at the edge of your ability, effort, feedback, correction. Which returns Hormozi's slogan in refined form. Volume negates luck when it is volume of the loop, repetitions that each include the feedback and the reflection, and volume of mere exposure negates nothing, a distinction his own gym analogy respects, since nobody confuses time spent in the building with sets taken to failure. Freire said it first and said it shorter: action plus reflection, or it does not transform anything, including you.

The field's native institutions already run the action half at scale, and the research on them is instructive in both directions. Capture-the-flag competitions have grown from hacker pastime to pedagogy: a 2021 study in Computers & Security analyzed 15,963 published CTF solution write-ups and mapped their content against the ACM/IEEE cybersecurity curricular guidelines, finding substantial coverage, strongest in cryptography and network security, thinnest in human factors. Cyber ranges, the full-scale simulation environments, earned a 2023 CHI paper the discipline needed: its authors observed that evaluation of such training is widely neglected and built a framework for doing it properly, trialed on a 50-student exercise. And a 2024 systematic review of cybersecurity training methods in Computers & Security counted what the studies measure: knowledge, far more often than behavior. The honest summary is that the field's hands-on culture rests on good instincts and thin outcome measurement, which is one more reason to run the loop whole rather than trusting the lab time alone. The action generates the experience. The reflection converts it.

So the habit, stated plainly: practice on the real thing, then write down what the practice meant. The write-up is the reflection half of praxis, and it is the difference between an evening that entertained you and an evening that changed you. The concrete forms are close at hand. Run the lab, then write the postmortem you would want to read: what broke, what the telemetry showed, what you believed at the start that turned out false. Play the CTF, then publish the walkthrough you wish you had found, an act with the convenient side effect of building public evidence of capability. Break your own environment on purpose, a deliberately misconfigured S3 bucket, a canary token tripped, and document the detection gap. After the real incident, write the version of events for your own file that names what you would do differently, separate from the sanitized ticket. None of this requires budget. All of it requires the discipline of the second half, which is exactly the half the banking model never asks for, because a deposit requires no reflection from the vault.

A closing note on the man, offered without sainthood. Freire has drawn serious criticism for the abstraction of his prose, and feminist scholars, Kathleen Weiler most carefully, faulted the early work's assumption of a single, male-voiced experience of oppression, criticism Freire acknowledged in later revisions and writing. And his method was built for peasants facing landowners, which invites the fair question of what business it has in a profession of cushy salaries. The answer is in Wednesday's subject and in his own definition. A professional whose study consists of receiving deposits, who cannot say what they can do, only what they have watched, is in a weak position against every party with an interest in telling them what they are worth. Freire's remedy for that condition was never the library. Rather, it was the loop.

As far as we can find, no peer-reviewed article has applied Freire to cybersecurity education; a systematic review of a decade of the field's education papers surfaces no mention of him. A profession built by autodidacts in home labs, learning from each other's write-ups, has been running an unnamed radical pedagogy for forty years. It deserves its name.

P.S. If this series earns a place in your week, the newsletter arrives weekly: subscribe at https://www.linkedin.com/build-relation/newsletter-follow?entityUrn=7464687787661926400

Sources

Encyclopaedia Britannica. (n.d.). Paulo Freire. In Encyclopaedia Britannica.

Ericsson, K. A. (2016). Summing up hours of any type of practice versus identifying optimal practice activities. Perspectives on Psychological Science, 11(3).

Ericsson, K. A., Krampe, R. T., & Tesch-Romer, C. (1993). The role of deliberate practice in the acquisition of expert performance. Psychological Review, 100(3).

Freire, P. (2000). Pedagogy of the oppressed (M. B. Ramos, Trans.; 30th anniversary ed.). Continuum.

Glas, M., Vielberth, M., & Pernul, G. (2023). Train as you fight: Evaluating authentic cybersecurity training in cyber ranges. In Proceedings of ACM CHI 2023.

Hormozi, A. (n.d.). How to catch up in life using logic [Video]. YouTube.

Instituto Paulo Freire. (n.d.). Paulo Freire chronology.

Macnamara, B. N., Hambrick, D. Z., & Oswald, F. L. (2014). Deliberate practice and performance in music, games, sports, education, and professions: A meta-analysis. Psychological Science, 25(8).

Macnamara, B. N., & Maitra, M. (2019). The role of deliberate practice in expert performance: Revisiting Ericsson, Krampe, and Tesch-Romer (1993). Royal Society Open Science, 6.

Prummer, J., van Steen, T., & van den Berg, B. (2024). A systematic review of current cybersecurity training methods. Computers & Security, 136.

Svabensky, V., Celeda, P., Vykopal, J., & Brisakova, S. (2021). Cybersecurity knowledge and skills taught in capture the flag challenges. Computers & Security, 102.

Svabensky, V., Vykopal, J., & Celeda, P. (2020). What are cybersecurity education papers about? A systematic literature review of SIGCSE and ITiCSE conferences. In Proceedings of the 51st ACM Technical Symposium on Computer Science Education (pp. 2–8). Association for Computing Machinery. https://doi.org/10.1145/3328778.3366816

Weiler, K. (1991). Freire and a feminist pedagogy of difference. Harvard Educational Review, 61(4).