The Journey of Mastery: Shu Ha Ri in Cybersecurity

#

In the quiet hours of an early morning, I sat staring at my screen, the blue light casting a glow over my increasingly frustrated expression. Another attempt at reverse-engineering a particularly elusive piece of malware had left me exhausted. Three weeks into my new role at a security firm, self-doubt began creeping in. Did I have what it takes?

My mentor, Eliza, noticed my struggle. “You’re trying to run before you can walk,” she said, pulling up a chair beside me. “Have you ever heard of Shu Ha Ri?”

The term was unfamiliar, so she explained: it’s an ancient Japanese martial arts philosophy that outlines the stages of learning on the path to mastery.

“In Shu, you follow the rules exactly. In Ha, you break the rules with understanding. In Ri, you become the rules.”

I nodded and listened to her guidance. For the next few months, I committed myself to disciplined imitation—the Shu phase. I meticulously followed established malware analysis procedures without deviation. Every step was documented, every tool used as intended. Slowly, I built a solid foundation.

Six months later, something shifted. As I analyzed a network intrusion, patterns emerged that didn’t fit neatly into our playbooks. I began combining techniques in creative ways, questioning why certain approaches worked better in specific contexts. This was Ha—thoughtful adaptation.

After two years of relentless practice, I reached a turning point. During an incident response for a critical infrastructure client, I found myself working almost instinctively. I wasn’t following a predefined methodology; instead, I responded fluidly to what the code revealed. Novel approaches to tracing the attack path came naturally, even surprising Eliza. This was Ri—natural innovation.

Now, as I mentor newcomers in offensive security, I share this journey. Learning in cybersecurity isn’t linear—it’s cyclical. Even as I reach Ri in one area, like malware analysis or OSINT, I find myself back at Shu when tackling cloud security or another unfamiliar domain. The willingness to start over as a beginner, paired with the wisdom gained from past mastery, creates the mindset of continuous growth that this field demands.

And so, the cycle continues: Shu, Ha, Ri—and then back to Shu once more. Because in cybersecurity, mastery isn’t a destination—it’s a continous process.