Shostack + Friends Blog


My Instructional Journey

Thoughts on my instructional journey - and what yours might be a boy walking through a the forest and passing by mushrooms, in the style of chiaroscuro figurative paintings, light sky-blue and gold, ephemeral installations, intricate, delicate flower and garden paintings, texture exploration, joyful celebration of nature, nightscape --ar 8:3 --v 6.0

The very first time I was asked to deliver threat modeling training, I had no idea how. And I thought I was fortunate, because my officemate at the time had been a professor, and so I asked him. And he told me “I have no idea! They just throw us into the deep end!” And while that’s sadly often true, it turns out there’s a huge field of study around pedagogy, instructional design, and more.

I’ve recently learned about the second edition of How Learning Works, and as I read it, I realize I want to talk more about the instructional design that now goes into our courses, and my journey to being a competent instructional designer.

To do that, let me go back to 2015. I’d left Microsoft to build a startup, and someone called and said: “can you come teach a one day threat modeling class? We liked your book!” and I said, sure. And so I went to their offices with a stack of powerpoint decks based on the book, and I raced through material because there was soooo much I wanted to share.

At the end of the day, I went and sat in my car, completely exhausted, for so long that site security came over to check if I was ok. Long story short, I asked: “Why am I so tired?” There were two answers. The first is because I care about my students and want them to learn, and the second is because I didn’t know how to teach. I talked to colleagues and for the first time understood the words “the person doing the work is the person doing the learning.” And I started to learn about teaching.

Fast forward to 2020, I had learned a fair bit about teaching. I had created formal learning goals, I’d adjusted what I taught to fit better in a day. And as I was about to be confronted with how much I still relied on whiteboards and how much I relied on face to face interaction to show that I cared about student progress. From that perspective, the pandemic was a chance to make some lemonade. I could hire instructional designers from all over to help with my design and delivery. I didn’t have to fly them anywhere to watch, I didn’t have to worry about if they’d be presentable in a corporate setting, and I got a lot out of value by bringing them in. It’s why I’m comfortable saying I’m competent at course design: Those consultants could have charged me a lot more if they had useful improvements to suggest. But I’m still learning, thus reading the 2nd edition of How Learning Works.

Recently, I was talking to a smart friend, and he said “I've been asked to create a training workshop for threat modeling here at work, and they gave me some old slides and syllabus. LOL if it wasn't so sad.”


Writing good TM content is time consuming, both for drafts and to refine it. I’ve been refining content for eight years. I’ve gone so far as to buying a teleprompter to help me record high quality video. We have subtitled video, exercises, instructor guides, timing sheets and more. As I mentioned, we’ve brought in instructional designers to help refine it. It’s hard to say how long I’ve spent on it, but for my first Linkedin Learning courses, it was about an hour of work for a minute of content. But Linkedin Courses don’t include the time students spend on exercises, so that’s not a perfect guide.

And so let’s say you “only” spend ten minutes per minute of the course. A one day course at 7 hours would be 70 hours of course design, or about 2 weeks. More likely, it’s a months-long project to get to alpha quality, and then more to hone and refine. And as you do, you’re spending the exceptionally expensive time and goodwill of your engineers on your beta.

So I’ll ask you what I asked him: Why not license ours? Much like adapting from in person to zoom, or live instruction to self-pace, the way we deliver can update and evolve.

Image by Midjourney