I’ve been authoring and teaching security courses with SANS Institute for over ten years. While helping to develop the overall curriculum we’ve tried to create a number of successful courses. But what do we mean by “successful”?

Many courses can have success but let’s focus on the big winners. The courses that become wildly successful. What does it take to create a blockbuster?

Topic

“When a great team meets a lousy market, market wins. When a lousy team meets a great market, market wins.”
- Andy Rachleff

The most important element in producing a wildly successful cybersecurity course is to choose the right topic. If it’s too niche people won’t attend. If it seems too dull then people won’t be interested. Take compliance as an example. Nearly every organization has some compliance requirements they have to meet. As a result, there are plenty of people who have compliance responsibilities. Despite this potentially large target audience, I have not seen a compliance focused course attain blockbuster status. Such items are often best served by sandwiching these “boring” but necessary topics in between sexier topics.

The best courses have a theme. Something that holds the course together from beginning to end. This theme is also evident in each of the individual learning objectives and helps drives the direction of the overall content. This is how you make something like compliance sexier. It’s just one part of the overall story.

The theme might not be obvious at first. As a kid I had a hard time finding the theme or unifying idea for my essays. Similarly, the theme for a course often won’t be obvious from the start. I’ve found that it can take months of iteration to land on a clear theme.

So, how do you find a great course topic and corresponding theme? You might be thinking, “Just find a problem that people are having.” Of course! But, this is much harder than it sounds. It’s not enough that you think people are having a problem. It matters what your students and customers are actually doing. To figure this out you need evidence.

Create situations where you can get market feedback. See what conference talks are highly attended. Run your own webcasts. For me the most interesting part of any talk are the questions asked by the audience. If you take the time to truly listen, these questions provide critical insight into the problems that people are having.

Talk to people but, more importantly, see what they do. Are there unexpected people with specific job roles attending certain classes or events? Are senior managers attending highly technical sessions? If so, it could point to an unmet need.

You’ll know when you’ve landed on a great topic. People will seemingly just show up.

Team

“When a great team meets a great market, something special happens.”
- Andy Rachleff

It’s actually pretty rare for a course to just become a blockbuster. More often you have a blockbuster idea but it takes hard work to turn it into a success. This is why the team is so important. When writing a course, the authorship team can have one or multiple authors.

First off, a course author has to have a deep love for the topic. You can’t teach this. They have been working in that specific area, have seen the problems first hand, and want to share with the world how to solve those problems.

Writing a course is extremely hard work. It’s one of the more difficult things I’ve done professionally. It takes a certain mindset to see a course to completion. Part of this is understanding that a successful course is a never-ending journey. The course is never “done” because it has to adapt to changing conditions and requires regular updates. You almost have to be thinking about it constantly. It truly is a labor of love.

The most successful course authors just get stuff done (#GSD). How do you know if someone is action oriented? There are small indicators like proactively identifying next steps and starting them even before the meeting ends. There are also more important indicators like taking the time to build a relationship with their co-authors and reaching out on a regular basis to get feedback on new material. Being open to feedback can be hard for some people. Prioritizing the feedback and acting on it can be even harder.

Things like work ethic, discipline, and being a lifelong learner matter. Combine these with the love and you have a winning combination. If the team doesn’t have these characteristics the course still might be successful but it usually becomes evident at some point the course won’t “cross the chasm” and fulfill its ultimate potential.

Timing

“You’ll break your pick for years trying to find customers who don’t exist for your marvelous product, and your wonderful team will eventually get demoralized and quit, and your startup will die.”
- Marc Andreessen

It’s possible to have a great topic and a great team but the course still doesn’t do well. Usually this is because of poor market timing. You don’t want to be too early but you don’t want to be too late.

How can you tell if your timing is good? Based on your research, talking to customers, and observing their behavior you should have a good sense of industry trends. But for a cybersecurity course you want to identify entrenched industry trends. It doesn’t do you any good to be right about a nascent trend because there won’t be enough students. For example, everyone knows the cloud is now inevitable. But if you created a cloud security curriculum the year after AWS launched you weren’t likely to get much traction. There also needs to be a market catalyst. For cloud that is digital transformation and the need for companies to move faster, change cost structure, and take advantage of accelerated macro trends.

So, how do you know if you have a blockbuster on your hands? That’s the trick. Topic, team, and timing. These are simple ideas but it turns out that they’re not so simple to get right.