With ExLENT Data Crossings participants having wrapped up their inaugural academic year, marked by capstone presentations this April, we’re looking back at one of the Explorations sessions that shaped the cohort’s journey: a hands-on cybersecurity workshop held in February.
On February 23, participants in ExLENT Data Crossings engaged in an Explorations course session focused on understanding how investigators make sense of complex incidents. The workshop was facilitated by the KC7 Foundation, a non-profit dedicated to making cybersecurity education accessible through game-based learning, and led by Bryan Quillen, director of curriculum and instruction, and Greg Schloemer, KC7 vice president and senior threat intelligence analyst at Microsoft. Participants were introduced to the mindset and methods used in real-world cyber investigations.
The session opened with a discussion on how analysts approach unfamiliar or rapidly evolving incidents. The KC7 facilitators highlighted essential professional skills that cut across fields: pattern recognition, critical assessment, curiosity, teamwork, and clear communication. Their broader point was that cybersecurity is not simply a technical specialty; it is a way of thinking that applies across disciplines and walks of life. Participants then examined two ransomware cases involving higher education institutions, which prompted a conversation about how unrelated events can appear connected when viewed side by side. This led to a broader discussion about analytical bias and the questions investigators ask to verify assumptions, including what happened, who was involved, and what evidence actually supports a connection. Building on these points, Greg described how analysts interpret signals, identify anomalies, and construct coherent narratives from incomplete information, highlighting the inherent uncertainty in real investigations.
The group also explored the ethics of teaching cybersecurity through games. Participants raised questions about whether gamification risks trivializing threats with serious real-world consequences, a tension the KC7 team acknowledged they continue to navigate in their own curriculum development. Bryan brought the stakes into focus by describing the operational reality of a large-scale ransomware incident where systems go dark, records become inaccessible, and organizations revert to manual processes, underscoring why immersive, story-driven experiences give learners a reason to care before they are asked to think analytically.
The session then shifted to a simulated incident response involving JoJo Hospital, a fictional Kentucky hospital facing a ransomware crisis. Working in teams, participants used Azure Data Explorer and Kusto Query Language (KQL) to analyze log data, respond to investigative prompts, and document their findings. The scenario was designed to surface the investigative turning point, the moment when fragmented data begins to form a coherent picture, which facilitators described as central to building confidence and judgment in new investigators. The hospital’s two-million-dollar Bitcoin demand and 72-hour deadline grounded the exercise in the kinds of high-stakes decisions real organizations face, particularly in healthcare settings where disruptions can delay patient care.
The workshop closed by reinforcing that cybersecurity is ultimately a way of thinking: recognizing patterns, asking sharper questions, testing assumptions, and communicating clearly. These skills form a versatile toolkit that spans across roles in research, policy, operations, leadership, and community engagement.
Stay tuned for our upcoming series highlighting the cohort’s capstone presentations to learn more about the work ExLENT Data Crossings Explorers brought to life this year. To learn more about the program, please visit the website.
Contact:
ExLENT Data Crossings Program
Lucy Family Institute for Data & Society / University of Notre Dame
exlentdc@nd.edu
lucyinstitute.nd.edu / @lucy_institute
About the Lucy Family Institute for Data & Society
Guided by Notre Dame’s Mission, the Lucy Family Institute adventurously collaborates on advancing data-driven and artificial intelligence (AI) convergence research, translational solutions, and education to ethically address society’s vexing problems. As an innovative nexus of academia, industry, and the public, the Institute also fosters data science and AI access to strengthen diverse and inclusive capacity building within communities.