Victoria Sanderson
CYSE 368
Spring 2026
Professor Teresa Duvall
Vital Solutions
Reflection Paper 1

Following my first couple of weeks in my cyber internship, I had to review many different types of tools that were used over the course of the 2 weeks. The second thing was completing ongoing training, such as cyber awareness courses, which need to be done annually in the job description. The third major thing I was focusing on was actively helping users with security concerns. The big point I learned while working here was that technology alone cannot protect an organization; there indeed needs to be a third party in the middle that makes sure all goes smoothly. To make this process easier its best to understand how to evaluate tools, stay current through training, and translate technical knowledge into practical help for everyday users.

To get more in-depth, each tool I had to learn and maneuver around really helped my understanding of cybersecurity further. The tools we are given are extensions to protect all their users, and it is an important responsibility in modern cybersecurity work. The company I work for, like many others rely on a wide range of tools that monitor endpoints, have response platforms, intrusion detection systems, vulnerability scanners, log management systems, and digital forensics tools. Each tool is designed to address a different part of the network and any vulnerabilities it may have, as there is no single solution that is sufficient on its own. For a thorough review, it involves understanding what a tool is designed to do, such as how it integrates with existing infrastructure, and whether it produces accurate and actionable alerts. In practice, this means testing tools in realistic environments, examining false positives, and determining whether analysts can easily interpret the results. For people working in security operations, incident response, or auditing roles, having the proper evaluation tools includes reviewing logging capabilities, data retention, reporting features, and compliance alignment. Alongside technical tool evaluation, continuous training is equally critical.

A big part of any company is training, as it allows for a hopefully safer environment for all its users. Cyber awareness and security training programs are one of the biggest courses you have to take annually to allow everyone to be taught how to keep their network safe. Even if there are technical tools that can detect many threats, they are often most effective when users are trained to recognize early warning signs and report them quickly. Cyber awareness training reinforces how phishing attacks work, why attackers use social engineering, and how even small mistakes can lead to larger compromises. As someone who regularly assists users, this training helps me communicate clearly and without technical jargon, making security guidance easier to understand and follow.

The third major part I had to do a lot of while working here was helping users who believe they are experiencing security problems. This helped me learn how to communicate with many different types of personalities and deal with some unnecessary problems that couldn’t have been learned through the training I stated earlier. Users are quick to rush to us for every issue, some include unexpected traffic, strange emails, account lockouts (not our job), strange login notifications (also not our job), or unusual system slowdowns (its windows updates). When a user reports a concern, we must carefully assess whether the problem is caused by malicious activity, misconfiguration, or routine system behavior. This process requires asking the right questions, preserving potential evidence, and avoiding actions that could unintentionally destroy valuable forensic data if need of an investigation. Even when a reported issue turns out to be benign, the response still matters. Providing clear explanations and practical guidance builds trust and encourages users to report future incidents rather than ignoring them.