TESDA's two-day cyber workshop is a start. Let's not call it a cyber skills push

Newsbytes reported this week that TESDA has partnered with Teqware Corporation and ThinkCyber to train the agency's own ICT personnel in threat detection, security investigations and incident response, using ThinkCyber's Cyberium Academy platform. Good. Government IT teams should be trained. But I read the announcement twice, and I want to be honest about what it describes, because the way these stories get framed matters.

What was actually announced

Going by the report, the facts are simple:

• The trainees are personnel from TESDA's own Information and Communication Technology Office (ICTO).
• It started on October 12 with an online orientation and platform onboarding session.
• A two-day, in-person workshop is set for October 26 to 27 at the TESDA Central Office in Manila.
• The topics: Linux systems, network services, scanning and enumeration, log analysis, scripting, malware concepts, and traffic analysis with Wireshark, plus simulated investigations in a lab.
• TESDA Director General Kiko Benitez described it as an initial step toward a broader partnership, and the partners pointed to possibly extending simulation-based training to TVET learners, schools, businesses and other agencies.

I could not find a separate TESDA press release on the program at the time of writing, so the Newsbytes report is the source here. Newsbytes illustrated it with an AI-generated image, which it labeled as such.

Two days is an orientation, not a capability

Look at that topic list again. Linux, network services, enumeration, logs, scripting, malware and Wireshark. Each one of those is weeks of hands-on work before someone is useful on a real incident. Packed into two days, after an online onboarding, it is an introduction to the topics and to the platform. That is not a criticism of whoever teaches it. It is just arithmetic.

I have spent my career on networks. Nobody becomes good at reading a packet capture in a workshop. You get good by staring at your own traffic, on your own network, week after week, until "normal" is burned into your head and the odd thing jumps out. You learn incident response by being on call when something actually breaks, and by writing up what went wrong afterward.

Training on a platform is not the same as training on your network

Lab environments and simulated investigations have their place. They are a safe sandbox to practice. But a program built around one vendor's platform naturally teaches that platform's labs and workflow. The real test for an ICT office is different: can the team spot trouble in its own logs, on its own systems, with the tools it actually runs every day?

That is the question I would ask of any vendor-delivered program, from anyone. When the onboarding ends, what stays behind? The skills, or a subscription?

Let's not call it a national skills push yet

The announcement talks about possible extension to TVET learners, schools, businesses and other agencies. That is a future possibility, not the program. Today, it is a workshop for one agency's own IT staff. If it does grow into something bigger, I will be glad to write about that too. Until then, I would rather we describe it for what it is.

What would actually help

If TESDA wants this to become real capability, and I hope it does, here is what I would like to see:

• Sustained practice. Regular lab time over months, not a one-time workshop. A few hours every week beats two intense days.
• Real duty. Put trained staff on an actual monitoring and incident response rotation for the agency's own systems, with runbooks and post-incident reviews.
• Your own data. Practice on the agency's own logs and traffic, so people learn what normal looks like where they work.
• Measurable outcomes. Publish simple numbers later: how many staff finished, what they can now do, and whether detection and response on TESDA's systems improved.
• Vendor-neutral foundations. Teach the fundamentals on open tools first, so the skills move with the people, whatever platform comes next.
• Mentors. Pair trainees with experienced practitioners who can review their work long after the workshop ends.

The intent is right. Government services are moving online, and Director General Benitez is correct that security matters for keeping them available. I just want the follow-through to match the press release. Call me in six months and show me the results. That will be the story worth writing.

Source: Newsbytes.PH, "Tesda to train ICT staff in threat detection, network analysis," October 22, 2026. Director General title per the TESDA Central Office directory.