A chain of techniques is not the same as a chain of decisions. Many training paths accidentally teach linearity: step one always leads to step two because the lab topology forces it. Real operations branch on telemetry, time, and risk.
Armory chains should make decision points visible: moments where two defensible paths exist and the learner must justify the pick.
Map decisions before mapping exploits
For each scenario segment, ask:
- What does the learner know at this point?
- What are two reasonable next actions?
- What signal would make them choose differently?
If only one action is viable, you have automation, not training. Widen the state space or add competing priorities (time pressure vs. stealth, breadth vs. depth).
Three chain patterns that hold up in review
Fork after reconnaissance
Recon produces more leads than time allows. The learner must prioritize targets using scope and impact, not completeness theater.
Fork after initial access
Initial access opens paths with different detection profiles. Document why one path was chosen and what was deprioritized.
Stop-or-continue gate
Introduce a explicit “continue / hold / exit” gate tied to scope and risk. This teaches operational stopping rules - see when to stop a scenario early.
Rubric what you grade
Grade decision quality with a simple rubric:
| Dimension | Weak signal | Strong signal |
|---|---|---|
| Prioritization | Random order | Tied to objectives and scope |
| Risk awareness | Ignores detection hints | Names tradeoffs explicitly |
| Evidence | Retrospective notes only | Captured during the run |
| Communication | Private notes only | Reviewer can follow without live narration |
Link chains to catalog intent
Publish chains with clear prerequisites on The Armory catalog entries: required skills, expected duration, and which reports from Intelligence Reports deepen the briefing - such as realistic mission design and evidence-first reporting.
Instructor note
When debriefing chains, ask learners to redraw the decision tree they thought they faced versus the tree the lab actually offered. The gap is usually where the next scenario should be designed.
