Abstract: A method comprises communicating training data to a computing device to in situ train a user on how to identify potential security incidents; tracking performance of the user based on the training data; and storing a profile of the user in a database, the profile indicating a level of performance of the user.