The Calendar Is the Strategy

Picture two analysts closing out their certification cycle. Both log the same 40 continuing-education hours. The first clears the obligation in one heroic December weekend, fourteen hours a day, coffee and video courses, and walks away with a completion certificate and a headache. The second spent the year on a schedule of unremarkable Tuesday hours, some of them spent revisiting material from months before. On paper, the two years are identical. In the head, they are different assets, and the size of the difference has been measured for over a century.

The measurement has a name, the spacing effect, and a literature large enough that the 2006 review by Nicholas Cepeda, Harold Pashler, and colleagues in Psychological Bulletin could synthesize 839 separate assessments of it across 317 experiments. The finding held almost without exception: study episodes separated in time beat the same episodes packed together. Of 271 direct comparisons, twelve failed to favor spacing. In studies with long retention intervals, the average advantage ran around 15 percent, on identical time invested. The review's most useful rule is the one calendar owners can apply: the longer you need to remember something, the longer the optimal gap between encounters with it. Material needed for next week can be revisited in a day or two. Material meant to last a career, which describes most of what a security professional learns, wants gaps measured in weeks and months. Cramming is tuned for the exam date. The job keeps no exam date.

The evidence extends past undergraduates in laboratories. A 2024 meta-analysis in the Journal of Medical Internet Research pooled randomized trials of digital education for working health professionals, clinicians balancing training against caseloads, and found spaced delivery beating massed delivery on knowledge outcomes with a standardized mean difference of 0.32. Health care is the analogy this field reaches for when it discusses continuing education, and on this question the analogy has data: professionals under time pressure retained more when the same content arrived distributed.

So why does nearly everyone cram? Because massed study feels better, and the feeling is measurably wrong. In 2008 Nate Kornell and Robert Bjork had learners study paintings and identify each artist's style, with a given artist's works either massed together or spaced apart. Spacing won convincingly: 78 percent of participants performed better with it. Then the researchers asked which method had worked, and 78 percent credited massing. The learners had the advantage in hand and voted against it because massed exposure produces fluency, a sensation of smoothness that short-term memory generates and long-term memory does not honor. Sunday's edition showed the same inversion in the retrieval experiments, where the repeated rereaders were the most confident and the worst performing. Bjork's name for the general principle is desirable difficulties: conditions that make study feel harder, spacing, testing, variation, tend to make learning last, while conditions that make study feel easy flatter you in the moment and abandon you at the incident. Alex Hormozi built a following mocking morning-routine theater, the productivity rituals people perform instead of the work; the massed rereading session is study theater, and the fluency it produces is the costume.

The second half of the habit is interleaving, and its signature experiment should unsettle anyone who finishes one course before starting the next. In 2007 Doug Rohrer and Kelli Taylor taught students four kinds of geometry problems, either blocked, all of one type before the next, or shuffled together. During practice, the blocked group looked far better, 89 percent accuracy against 60. On the test one week later, the shuffled group scored 63 percent. The blocked group scored 20. The practice that felt like mastery had been rehearsing recognition, because when every problem in the set is the same kind, you never practice the decision that opens every real problem: What kind is this? A 2019 meta-analysis by Brunmair and Richter tempers the claim usefully: across 59 studies, the average benefit was moderate (g = 0.42), strongest where the learner must discriminate between similar, confusable categories, absent for expository text, and reversed for simple vocabulary. Read that boundary condition against this field's work. Is this alert lateral movement or an administrator's late night? Is the packet capture exfiltration or a backup job? Is this clause a SOC 2 finding or noise? Discriminating between similar, confusable categories is the job description of triage. The evidence says to practice it the way it arrives, mixed.

Now assemble the habit. The profession's continuing-education regimes, ISC2's 120 credits per three-year cycle with 40 a year suggested, ISACA's 120 with a floor of 20 a year, CompTIA's 50 units per cycle, were designed as compliance instruments that count hours attended rather than skill gained, and read that way they invite the December weekend. Read as scaffolding, they are a spacing schedule waiting to be used: the cycle already assumes the hours will be distributed, and the renewal date already assumes the knowledge should outlive it. The practical moves are unglamorous. Put a recurring hour on the calendar and defend it the way you would defend a patch window. Keep a spaced-repetition deck for the pure recall layer of the job, port assignments, protocol behaviors, command syntax, control mappings, and let the algorithm schedule the gaps, since tools built on this research (Anki is the common choice) exist and are free. Resurface your own material: a calendar recurrence that reopens last quarter's incident postmortems or audit findings costs nothing and converts documents nobody rereads into a curriculum. Rotate topics within the week, cloud identity on Tuesday, detection engineering on Thursday, back to cloud the following week, rather than serializing the year into finished courses. And bind the habit to Sunday's article: when the calendar surfaces a topic, begin closed-book, writing what you still hold before opening anything, because a spaced session that starts with retrieval compounds both effects.

One objection deserves a straight answer: nobody has the time. The field's own data agrees, and then points the other way. In ISC2's June survey of nearly a thousand large-enterprise security leaders, 73 percent said training budgets rose this year, while 53 percent named time and scheduling, ahead of money, as the main barrier to effective training. The SANS/GIAC workforce report found the same rank order, time at 60 percent, budget at 54. Time scarcity is an argument for efficiency, and spacing is an efficiency technology: the same hours, scheduled differently, yielding measurably more retention. The December weekend and the Tuesday hours cost the same. Only one of them is still there in March.

The habit also has a native translation. This profession does almost nothing important as a one-time event. Patching is a cadence, and so are backups, access reviews, phishing simulations, and tabletop exercises, because the field learned that point-in-time assurance decays. Knowledge decays the same way, on a curve psychologists have plotted since the 1880s. The professionals who compound are the ones who put their own minds on a maintenance schedule. The calendar is the strategy; the hours were never the problem.

Next in the series: the lab, the write-up, and a Brazilian educator whose word for the loop between them, praxis, this field has been living without knowing it.

And if this series earns a place in your week, the newsletter arrives weekly: subscribe at https://www.linkedin.com/build-relation/newsletter-follow?entityUrn=7464687787661926400

Sources

Bjork, R. A. (1994). Memory and metamemory considerations in the training of human beings. In J. Metcalfe & A. P. Shimamura (Eds.), Metacognition: Knowing about knowing (pp. 185–205). MIT Press. https://doi.org/10.7551/mitpress/4561.003.0011

Brunmair, B., & Richter, T. (2019). Similarity matters: A meta-analysis of interleaved learning and its moderators. Psychological Bulletin, 145.

Cepeda, N. J., Pashler, H., Vul, E., Wixted, J. T., & Rohrer, D. (2006). Distributed practice in verbal recall tasks: A review and quantitative synthesis. Psychological Bulletin, 132(3).

CompTIA. (n.d.). Renewing Security+.

Ebbinghaus, H. (1885). Uber das Gedachtnis: Untersuchungen zur experimentellen Psychologie [On memory: Investigations in experimental psychology]. Duncker & Humblot. https://www.loc.gov/item/e11000616/

Hormozi, A. (n.d.). How to catch up in life using logic [Video]. YouTube.

ISACA. (n.d.). Maintain CISA certification.

ISC2. (n.d.). Member policies.

ISC2. (2026, June 10). How enterprises use training to strengthen cybersecurity teams.

Kornell, N., & Bjork, R. A. (2008). Learning concepts and categories: Is spacing the “enemy of induction”? Psychological Science, 19(6).

Martinengo, L., Ng, M. S. P., Ng, T. D. R., Ang, Y.-I., Jabir, A. I., Kyaw, B. M., & Tudor Car, L. (2024). Spaced digital education for health professionals: Systematic review and meta-analysis. Journal of Medical Internet Research, 26, e57760. https://doi.org/10.2196/57760

Rohrer, D., & Taylor, K. (2007). The shuffling of mathematics problems improves learning. Instructional Science, 35.

SANS Institute & GIAC. (2026, March 11). 2026 cybersecurity workforce research report.