What is FifthDomain skills data?
Skills data on the FifthDomain platform refers to information about the cyber skills a participant has demonstrated. This data is generated through participation in various FifthDomain events, including competitions, assessments, trainings, and courses.
Skills data input sources
Currently, there are two main content sources that generate skills data:
Challenges: These are found in competitions, assessments, and trainings.
Lessons: These are found in courses on the platform.
Each input source is weighted differently, based on how accurately it reflects real-world skill. Challenges are hands-on and experiential, while lessons are more theoretical and passive in nature. Therefore, successfully completing a challenge contributes to a participant’s skills data more than completing a lesson.
Skills data input source weighting
+1 for every unique challenge completed.
+0.3 for every unique lesson completed.
Note that each unique challenge or lesson only contributes to a participant's skills once. Repeating the same challenge or lesson in different events will not add additional skill data after the first successful completion.
How content is mapped to skills
Each challenge and lesson is mapped to the FifthDomain Cynaptic Adaptor, which maps content to the following three components - Professional Specialties, Skills, and Proficiencies.
When you complete a challenge or lesson, you showcase ability in its mapped Professional Specialty and Skill (at the set Proficiency level).
About Professional Specialties
Professional Specialties (also called Specialties) group all cyber skills demonstrable on the platform to overarching high-level cyber work specialisations. Each lesson on the platform is mapped to one of six Specialties.
FifthDomain's Six Professional Specialties:
Intelligence: Cyber work which relates to the collection of information on the open or dark web outside of one's own network. This can include removing friendly information as an Operational Security (OPSEC) measure.
Penetration: Cyber work which relates to gaining unauthorised access and ability to make modification to a system.
Protection: Cyber work which relates to hardening one's own systems, identifying system configurations that protect from threats, and finding vulnerabilities.
Detection: Cyber work which relates to searching systems, sources, and information points to detect events, and identifying and moderating a comprehensive list of relevant observables.
Engineering: Cyber work which relates to building Security Operation Centre (SOC) technologies in order to make technologies better and faster.
Investigation: Cyber work which relates to the analysis of artefacts to derive Indicators of Compromise (IOCs), and reveal a full behaviours and capabilities.
About Skills
Each Specialty consists of 5-6 skills. Skills are more granular sets of abilities and knowledge related to a more specific area of cybersecurity. For example, the Log Analysis (LA) Skill is mapped to the Detection Specialty. There are approximately 30 skills demonstrable on the platform. Each skill sits within one of the six Specialties.
Each challenge and lesson is mapped to 1-3 skills within its set Specialty. For example, a Detection lesson may be mapped to the Log Analysis (LA) and Traffic Analysis (TA) skills. However, it can't be mapped to skills outside of the Detection Specialty.
About Proficiencies
Proficiencies determine a participant's level of ability in a particular skill on the platform. There are five proficiency levels that participants can demonstrate. These are modelled from the Dreyfus Model of Skills Acquisition, described below:
The Five Proficiency Levels (per the Dreyfus Model of Skills Acquisition):
Level 1 (Novice): Demonstration of a basic but incomplete understanding of a concept, and a mechanistic approach requiring supervision for relevant work completion.
Level 2 (Advanced Beginner): Demonstration of a working understanding of a concept, and a perception of required actions as steps. Those at this level can an complete simpler tasks independently.
Level 3 (Competent): Demonstration of a good working and background understanding of a concept, with contextual awareness. Those at this level are capable of independent work to an acceptable standard.
Level 4 (Proficient): Demonstration of deep understanding of a concept, complete with a holistic view of required actions. Those at this level consistently achieve high standards when performing relevant work.
Level 5 (Expert): Demonstration of authoritative and/or deep holistic understanding of a concept, complete with intuitive handling of routine relevant matters. Those at this level excel effortlessly when performing relevant work.
Each challenge and lesson is mapped to one of the five proficiency levels.
How skills data is visualised
Skills data on the FifthDomain platform is displayed through a visualisation called the Cyber Skills Cortex. This is a heatmap-like diagram that conceptually mirrors the structure and shape of the human brain, presenting an overview of a participant’s demonstrated skills.
The Cyber Skills Cortex highlights:
Which skills a participant has demonstrated
Which Specialties those skills align with, and
What proficiency levels have been shown within each skill
About the Cortex
The Cortex is divided into six sections, each representing one of six Specialties.
Specialty pairings on the Cortex
These specialties are subtly grouped in pairs based on their functional similarities:
Cortex Upper: Intelligence and Penetration
These relate to interacting with external systems, devices, and information sources to achieve specific outcomes.
Cortex Middle: Protection and Detection
These relate to systems administration and operational work within secure environments.
Cortex Lower: Engineering and Investigation
These involve assembling or disassembling systems, artefacts, and associated information to understand or alter their function.
Every Skill is represented by a row in its respective Specialty. Each row contains five squares, with each square corresponding to one of the five proficiency levels that can be demonstrated for that Skill. These are referred to as Skill-Proficiency squares.
Reading a Cyber Skills Cortex
Blank vs filled squares
In the Cortex, each Skill-Proficiency square represents a user's progress in a specific skill at a specific proficiency level. These squares change based on activity.
Blank squares indicate that a user has not yet completed any challenges or lessons associated with that skill and proficiency level. Once a relevant challenge or lesson is completed, the corresponding square will be filled.
The colour intensity of a filled square reflects the number of unique completions relevant to that square. The more unique challenges or lessons a user completes that align to that skill and level, the darker the square becomes.
Hovering over Skill-Proficiency squares
To view more information about a specific Skill-Proficiency square, hover your mouse over it. A tooltip will appear, providing the following details:
Full Skill Name (expanding any acronym)
Full Proficiency Name
Depending on the context of the Cortex you're viewing (i.e. whether it's your own Cortex, another person's Cortex, or the cumulative Cortex of multiple users), you will also be able to see other information, such as:
Total Challenges Solved (number of unique challenges completed)
Total Lessons Completed (number of unique lessons completed)
Last Activity (date of the most recent activity)
Current Contributors (the number and names of users who are contributing skills data for a square in the context of a cumulative Cortex)
Links between proficiency levels
The Cyber Skills Cortex applies a cascading logic when it comes to Skill-Proficiency squares. Demonstrating a Skill at a higher proficiency level also contributes to your ability in lower levels of that same Skill.
Example:
Completing a Level 3 (Competent) Intrusion Detection (ID) challenge will:
Increase the shade intensity of the Level 3 ID Skill-Proficiency square.
Simultaneously deepen the colour of the Level 2 (Advanced Beginner) and Level 1 (Novice) ID squares.
This cascading effect ensures that Skill-Proficiency squares will naturally appear darker toward the central spine of the Cortex (where higher proficiencies are located), and lighter as you move outward, toward the lower proficiency levels on the left and right edges.
Skills degradation
Skills naturally fade without continued application, and the Cortex reflects this through skills degradation logic. Each square will lose colour intensity as the challenges and lessons that contributed to it no longer count toward skills data.
The time it takes for a challenge or lesson to degrade depends on proficiency:
Level 1 (Novice) challenges and lessons stop counting after 2 months.
Level 2 (Advanced Beginner) challenges and lessons stop counting after 3 months.
Level 3 (Competent) challenges and lessons stop counting after 5 months.
Level 4 (Proficient) challenges and lessons stop counting after 8 months.
Level 5 (Expert) challenges and lessons stop counting after 13 months.
As time passes without new activity, Skill-Proficiency squares will gradually fade, reflecting the natural decline of skill without continued practice. The only way to restore a square’s colour is by completing new, relevant challenges or lessons at the relevant proficiency levels.
Understanding Skill Scores
A skill score represents the current cumulative score a user has earned from completing challenges and lessons across all proficiency levels within a given skill. Degraded skills data doesn't count toward this score.
Example:
If a user has completed 3 Secure Coding (SC) lessons and 2 Secure Coding challenges, their total earned score would be:
3 lessons × 0.3 = 0.9
2 challenges × 1 = 2.0
Total earned score = 2.9
If 1 lesson and 1 challenge have degraded (based on the timeframes defined by the skills degradation logic), their current skill score would be:
2 lessons (0.6) + 1 challenge (1.0) = 1.6
This reflects a score degradation of 1.3 over time.
Viewing Skill Scores on the Cortex
For every skill with active, non-degraded data, the user's current skill score will appear as a number next to the skill’s abbreviation on the Cortex. You can click on a skill to expand your view and access the following:
Skill Score Summary
Total score earned over time (including currently degraded scores)
Total score degraded over time (how much has been lost to degradation)
Upcoming degradation (when and by how much the score will next decrease)
Proficiency Split
This displays how the current skill score is divided across input types (i.e. challenges vs lessons), and across proficiency levels.
Timeline
Visualised as a waterfall diagram, this shows how the skill score has changed month by month. You can also filter your view to specific months.
Note: this expanded view is not available in the following Cortex versions:
Participant Home Page Snapshot Cortex
Function Cortex
Workforce Cortex
Different Versions of the Cyber Skills Cortex
The FifthDomain platform provides multiple views of the Cortex, tailored to different contexts. The versions of the Cortex you can access depends on your permissions and platform mode.
Participate Mode Cortexes
Participant Home Page Snapshot Cortex
A non-interactive view of a participant’s own Cortex.
Displays a snapshot of current skills to date.
This version of the Cortex is visible to all users.
Participant Skills Page Cortex
An interactive view of a participant’s own Cortex.
Allows users to filter and explore their skill development across time.
This version of the Cortex is visible to all users.
Manage Mode Cortexes
Affiliated User Profile Cortex
A manager’s view of a user affiliated with their organisation.
Displays all skills the user has demonstrated across all platform events.
The Affiliated User Profile Cortex is visible to managers in organisations with one of the following permissions:
Manage Users
Manage Functions (Org Designers)
Manage Squads (Function Leads and Squad Managers)
Manage Events
View Insights
Non-Affiliated User Profile Cortex
A manager’s view of a non-affiliated user.
This version is limited to showing only the skills data generated within the manager’s organisation. Skills earned outside the organisation are not visible.
The Non-Affiliated User Profile Cortex is visible to managers in organisations with one of the following permissions:
Manage Users
Manage Events
View Insights
Squad Cortex
This is a Cortex showing the combined skills of all members in a specific squad.
Managers can use this view to identify strengths, gaps, or development opportunities at the squad level.
The Squad Cortex is visible to managers in organisations with:
Manage Squads (Squad Managers)
Function Cortex
This is a Cortex showing the combined skills of all members within a specific function in the organisation.
Managers can filter by individual members within the function.
The Function Cortex is visible to managers in organisations with one of the following permissions:
Manage Functions (Org Designers)
Manage Squads (Function Leads)
Workforce Cortex
This is a cumulative Cortex showing the combined skills of all affiliated users within the organisation.
Skills are aggregated across functions. Managers can filter by function to focus on specific parts of the workforce.
The Workforce Cortex is visible to managers in organisations with one of the following permissions:
Manage Functions (Org Designers)
Manage Squads (Function Leads)