In the fast-paced world of cyber threats, having a well-trained team is crucial for military cyber operations. In order to train cyber operators effectively, a structured approach to developing training programs is vital. That’s where ADDIE comes in.  

The ADDIE model—Analysis, Design, Development, Implementation, and Evaluation—is a framework used by instructional designers and training developers to explain, “...the processes involved in the formulation of an instructional systems development (ISD) program for military interservice training that will adequately train individuals to do a particular job (Branson, et al., 1975).

Today we’re exploring how the ADDIE model can be applied to military cyber operations, highlighting real-world examples and best practices to enhance your cyber team's readiness and capabilities.

A is for Analysis

The foundation of any successful training program is a thorough analysis of your team’s needs. This phase helps you understand where your team stands and what they need to learn to be more effective.

Identifying Needs and Setting Objectives

Start by evaluating your team’s current capabilities to identify strengths and areas that need improvement by conducting comprehensive skill assessments. Stay up to date on emerging cyber threats, regularly updating threat analyses, and understand their potential impact on your operations. Define clear, measurable training objectives that align with your mission objectives.

The 39th Information Operations Squadron (39 IOS) and their Reserve counterpart, the 717th Information Operations Squadron (IOS), spearheaded the effort to identify gaps in missions partners cyber capabilities and incorporate it into their training. They discovered a need for advanced training in offensive cyber tactics, including the expansion, co-location, and integration of the training community with operators, which shaped their targeted training program​.

D is for Design… and Planning

Once you know what your team needs, it’s time to design a training program that addresses those needs. This phase involves creating a detailed plan that outlines how to achieve your training objectives.

Developing Effective Training Plans

When developing effective training programs, start by creating realistic cyber-attack scenarios that your team might face. Organize the training content in a logical sequence to ensure all necessary topics are covered. Design assessments that measure both your team’s progress and the program’s overall effectiveness. Work closely with Subject Matter Experts (SMEs) to keep your content accurate and up to date.

The 39th IOS Detachment 1 at Joint Base San Antonio, Lackland “is home to one of the Air Force's cyber and  information operations formal training unit where […] experienced Airman, civilian and contract instructors teach future cyber warriors…” writes First Lieutenant Lauren Woods. “All cyber training is driven by real-world operational needs, so courses undergo refreshes and improvements on a six-month deliberate development cycle” (Woods, 2018).

D is for Development

Once in the development phase, you will create the instructional materials and content based on your design plan. This is where your planning starts to take shape.

Creating High-Quality Training Materials

Develop detailed training materials like presentations, manuals, and interactive modules. Use and leverage advanced tools and technologies like cyber ranges and simulation environments to create an immersive learning experience. Regularly review materials with SMEs and incorporate their feedback regularly to ensure quality. Update your training materials regularly to keep pace with the evolving threat landscape.

The Department of Defense (DoD) used real-world cyber incidents to develop scenarios for their training programs, specifically during the U.S. Cyber Command's Cyber Flag 21-1 exercise, one of three distinct cyber field training exercises that USCYBERCOM conducts annually. "This is an important exercise because we bring our cyber operators here to have a scenario where they can train their defensive measures," said German Vice Adm. Dr. Thomas Daum, Chief of the German Cyber Information Domain Service (U.S. Cyber Command Public Affairs, 2021).

I is for Implementation

The implementation phase is all about delivering the training program to your team. This phase requires careful planning to ensure everything runs smoothly.

Executing and Delivering Training Programs Effectively

Conduct the training sessions using various methods, such as in-person workshops, online courses, or a blend of both. Train your instructors to deliver content effectively and support learners. Provide resources and assistance to help your team succeed. Combine in-person and online training to accommodate different learning preferences. Implement mechanisms for immediate feedback, helping trainees understand and correct mistakes quickly.

The benefit of the Cyber Flag 21-1 being a multinational exercise is that it enabled partnership with the National Cyber Range (NCR) using customized and virtual network environments designed to meet the specific needs of each participating military unit.

"The great thing about the National Cyber Range is it's accessible if there's a node that you can get on. We have nodes all over the world, so you can actually do an exercise and distribute it over multiple time zones," said U.S. Coast Guard Rear Adm. Christopher Bartz, USCYBERCOM's Director of Exercises and Training. "NCR can do a lot of things that normal cyber ranges can't do. It can immediately deploy a network, and then you can reuse the content for multiple instances." (U.S. Cyber Command Public Affairs, 2021).

E is for Evaluation

The final phase of the ADDIE model is evaluation. Here, you assess the effectiveness of your training program and identify areas for improvement.

Evaluating and Enhancing Training Programs

Gather feedback during the training to make real-time adjustments. Perform ongoing, formative assessment throughout the creation of your briefings and training courses, especially if they are complex web-based courses, which can be costly to revise. Conduct comprehensive assessments at the end of the training to measure its overall effectiveness.

In the Developing a Security Education and Training Program provided by the Center for Development of Security Excellence, they recommend performing an evaluation at the end of a course, known as summative evaluation. This evaluation will provide several levels of feedback including:

• Reaction: Feedback on whether the learners enjoyed the training and were engaged in the course, typically assessed through evaluation forms.

• Learning: Assessment of how much students learned, often measured by exams at the end of the course.

• Behavior: Evaluation of whether students apply what they learned on the job, such as following security procedures.

• Return on Investment: Determination of whether the desired organizational change was achieved, like a reduction in security violations and enhanced national security.

The results of this evaluation will help refine and enhance future training programs. Use both qualitative and quantitative methods to get a complete picture of your training's impact. Involve key stakeholders in the evaluation process to ensure their perspectives are considered. Even though evaluation is the final phase ADDIE model process, it’s important to conduct ongoing, formative assessments throughout the development of your briefings and training courses, particularly for complex and costly web-based courses.

Conclusion

The ADDIE model offers a powerful framework for developing comprehensive training programs for military cyber operations. Although the steps in the ADDIE framework can be performed in a strict linear fashion, it is often executed in an iterative, or cyclical, fashion, where each step influences the next and loops back into the process. In general, it is most useful to begin with “Analysis” and proceed through “Design” and “Development” into “Implementation.”

By systematically analyzing needs, designing targeted content, developing high-quality materials, implementing effective delivery methods, and continuously evaluating outcomes, you can enhance the readiness and capabilities of your cyber team. Integrating best practices and real-world examples ensures that training is relevant, impactful, and aligned with operational goals. As cyber threats continue to evolve, adopting a structured approach like the ADDIE model is essential for maintaining a robust and resilient cyber defense, further ensuring the ongoing success and effective management of these government projects.

Sources:

1. AFCEA International. "Train Like You Fight, Even in Cyberspace." AFCEA, www.afcea.org/content/train-you-fight-even-cyberspace.

2. Branson, R. K., et al. Interservice Procedures for Instructional Systems Development. 5 vols., TRADOC Pam 350-30 NAVEDTRA 106A, U.S. Army Training and Doctrine Command, Aug. 1975. NTIS No. ADA 019 486 through ADA 019 490, https://apps.dtic.mil/sti/pdfs/ADA019486.pdf.

3. Center for Development of Security Excellence. Student Guide: GS104 Security Program Management. U.S. Department of Defense, www.cdse.edu/Portals/124/Documents/student-guides/GS104-guide.pdf.

4. MITRE ATT&CK. "Adversarial Tactics, Techniques, and Common Knowledge." MITRE, www.attack.mitre.org.

5. National Institute of Standards and Technology (NIST). "NIST Cybersecurity Framework." NIST, www.nist.gov/cyberframework.

6. SANS Institute. "Cyber Programs for the U.S. Military." SANS, www.sans.org/us-military-programs/.

7. U.S. Department of Defense. Department of Defense Cyber Strategy 2018. DoD, 2018, https://media.defense.gov/2018/Sep/18/2002041658/-1/-1/1/CYBER_STRATEGY_SUMMARY_FINAL.PDF.

8. U.S. Cyber Command Public Affairs. "DOD's Largest Multinational Cyber Exercise Focuses on Collective Defense." U.S. Department of Defense, 6 Dec. 2021, www.defense.gov/news/news-stories/article/article/2863303/dods-largest-multinational-cyber-exercise-focuses-on-collective-defense/.

9. Woods, Lauren. “39th IOS Provides Cyber Warriors for Army, Navy, Marines, Air Force.” DVIDS, Defense Visual Information Distribution Service, 4 Jan. 2018, https://www.dvidshub.net/news/printable/261988.