The Cyber Success Vector™: Building Mission-Ready Cyber Talent

Douglas Gray

Cybersecurity mandates across defense, aerospace, and life-critical systems are growing in urgency and complexity. Whether facing CMMC compliance, Agile integration, or zero-failure system demands, organizations increasingly depend on more than just secure code — they need people who are capable, aligned, and ready for what’s next.

This talk introduces the Cyber Success Vector™, a leadership and workforce development model designed to grow mission-ready cyber professionals. Fully compatible with the DoD Cyber Workforce Framework (DCWF), this model enables organizations to:

Build and sustain DCWF-aligned competencies across diverse roles
Integrate cyber readiness into Agile and DevSecOps environments
Align people capabilities with mission risk and system assurance needs
Develop leadership at every level—from practitioners to program managers
Prepare not only today’s workforce, but also shape the future force in cybersecurity

The presentation includes actionable tools to assess, grow, and retain cyber talent in high-stakes environments — where operational resilience and human readiness are critical to mission success.

https://softwareexcellencealliance.org/the-cyber-success-vector-building-mission-ready-cyber-talent-for-life-critical-and-defense-systems/

Follow the link above to watch the presentation and view the slides. Then join the discussion by posting your questions and ideas here. The presenter and the SEA community will chime in with their responses and thoughts.

Julia Mullaney

What do you do with something like phishing? How does that cut across your vectors? It's probably the most common attack vector.

Douglas Gray

Julia Mullaney So the way I see this, you start from the wide and then you go to specific. For example, there are a lot of KSAs. I found 16 knowledge, skills, and abilities inside of NICE that were common to every single work role. We start from the general, which might be knowledge of a threat actor or attack pattern; then you break that down into the eaches.

In your example, phishing is a problem that affects everybody. But other things like sanitizing code and preventing different injection patterns will be important for our software developers.

Looking at each, we go back to Bloom's taxonomy: how much does that person need to know? For your risk executive function, they need to know a lot: they probably need to be up at level five or six of Bloom's taxonomy. But your average user probably only needs to be at two or three. This helps us decompose it and ask what "apply" means for a particular knowledge, skill and ability. For an average user, it means "don't click a link."

And now a warning: it's easy to go crazy with any framework. I've had my own mad scientist moments, and I have to remind myself to step back and take a breath. My colleagues from my time at the Software Engineering Institute will remember my mantra that any framework has to live in the real world. A framework can be academically elegant but if it doesn't solve a human problem, it's not going to help.

Julia Mullaney

Can you give us the reference to the study you mentioned about the aircraft armor?

Douglas Gray

Julia Mullaney Here it is:

https://medium.com/@christian.dobbert/the-missing-bullet-holes-and-abraham-wald-25e68d7a870f

Julia Mullaney

I love how you said that it's all about people. You've worked in many different domains, including intelligence; what are some of the "people things" that gave you the "aha" moment to create this framework?

Douglas Gray

Julia Mullaney Every organization I go into has a humongously different way of looking at the world.

My constructive critique of the intelligence community is very similar to my constructive critique of the communications community in the Army: often people's time horizon is about a week in the future and a week in the past. I have a whole section in my book on maturity with those two particular groups: their culture is such that you have to remind them the underlying structure is there.

But I've also worked in the Army human resources community who are on the exact opposite side, because they deal with things that have time horizons of 20 or 30 years. And everybody must be kumbayatic, everything must go through a particular procedure, to the point where it just grinds to a halt.

So I thought, maybe there's a way to come back to brass tacks. Throughout my career, I've always found it helpful to come back to center; because we can get so we can get so tied up in the culture of an organization that we lose objectivity about it.

That's one of the things I love about frameworks. You use the framework, you don't let the framework use you.

Steve Shook

Where did the idea of this framework come from? You mentioned that many elements are based on other frameworks and other taxonomies, even from completely different industries. What coalesced in your mind to create this Cyber Success Vector idea?

Douglas Gray

Steve Shook I have a strange answer to that, and it is addiction. But not the addiction that you're thinking of.

Throughout my career, both before and during my time in the military, I've had the privilege of working on high performing teams: where everybody is working at full capacity, and everybody's keying off of each other; and that experience is addictive. And just like addiction, you're constantly chasing that previous high, asking "How do I get back there?"

Of course, every place has its good points and bad points. But sometimes you find yourself thinking "things could be so much better," or "this group could be so much better," and you're chasing that high-performing high. So I decided to put what I'd learned into something people can follow. This framework is the result of me putting my money (and certainly my time) where my mouth is.

Attendee

Kay Lock Kolp: I've just moved to a rural part of Maine. And more than once, when I'm talking to people who've lived here for a long time, what I hear is, "I may not like you, but I'm going to pull you out of the ditch when you fall in. And you're going to help me too, right?"

As I've been listening to you, I can't wait to read your book. It feels like what you've done here so beautifully, Doug, is that you've created a framework that a lot of different people can see through their own lenses at something that's really common to everyone. And to me, there's an aspect of it that really feels like trust.

You and I have known each other for a long time; so I was just curious if this has been something that's emerged over your work, over your life, or is it something that you've just started reflecting on relatively recently?

Douglas Gray

Attendee You know, when you're an army officer, it's almost like it's in your job description to pound your chest about leadership. I've been through so many different talks from senior officers about what leadership should be. You pick out little bits and pieces of that and start doing the same thing yourself over the course of time.

There was a high-performing organization I was the leader of back in Germany, and people still reach out years later to say thank you. We all want to get back to that, so I've tried to ask how we can create a structure to do that on a repetitive basis. It has to be more than simply pounding my chest about leadership.

Every so often I'm annoyed by posts on LinkedIn or elsewhere about "the top 10 things to being a leader." Wow, who knew it was that easy? I'm glad I saw this post and I only have to do these 10 things.

We know, especially with different situations, that what worked the last time is not going to work the next time. You have to come to basics. So I asked if I could create a way of engaging every particular situation over and over again, how could I make that work for me? And could this work for others too?

Steve Shook

Building on what you just said, it seems like a lot of this framework can be extended beyond cyber security. This idea of the three axes of breadth and depth and scope, and the gradations along each of those axes, is a very powerful idea.

Douglas Gray

Steve Shook Honestly, that's the logical next phase. As I was developing this, I posed this question to a behavioral anthropologist that I worked with at the Senate, who I respect highly. I said, "I think this could be used anywhere. Should I just make it generic?" He advised, "No - you're a cyber guy. Write what you're passionate about, and that specificity will come through. Later down the road you can extend that out into other areas."

I've mapped the levels in the book to other areas, like military ranks and government paygrades. And course, Bloom's taxonomy is applicable everywhere. You can apply these scope levels and core attributes to whichever domain you need. I just happened to start with cyber because I'm a cyber guy.

Julia Mullaney

For anyone that wants to know more, Doug has a book available from Amazon. See the link below. If you get it, please leave a review.

https://www.amazon.com/Total-Pro-Future-Ready-Through-VectorTM/dp/B0FQHR5NC7

Douglas Gray

Julia Mullaney Thank you! And thanks again everyone for the great discussion!