What Passing the CISSP Taught Me About Human Resilience

The exam proctor handed me a folded piece of paper. I didn’t want to see the results yet.

I was still shaken from the intensity of finishing that grueling 3-hour exam. I even struggled to open my locker to gather my personal belongings.

I walked down the hall and read my result standing in a bathroom at a testing center in Schaumburg, Illinois.

Congratulations. You have provisionally passed.

Provisionally, because the credential is not official until the endorsement process clears. That is underway.

That was Friday afternoon. Today, Sunday, I am still processing it.

This is not a post about exam content.

The (ISC)² Code of Ethics is clear, and I intend to honor it.

There are no test questions here, no recalled items, nothing that belongs behind the testing center door.

This is a post about the seven years it took to get to that testing center, and what passing the CISSP taught me about how humans actually endure hard things.

Why This Certification

I first saw the CISSP around 2018.

I was at a health insurance company, running a large project loaded with security requirements, working shoulder to shoulder with the security officer and his engineers.

I asked them a simple question. What certification should I be looking at if I want to stand out in Cybersecurity?

They told me. I looked it up. And I remember the exact feeling.

This is a mountain. I am not sure I can climb it.

So I put it down. It became a someday thing.

Here is what makes it a mountain.

The CISSP spans eight domains, from security and risk management to software development security. It is a mile wide and deep enough in every direction to hurt.

It is a computer adaptive test, which means the algorithm adjusts to you in real time. You cannot flag a question. You cannot go back. Every answer is final the moment you commit to it.

The exam ranges from 100 to 150 questions across three hours, and it ends when the algorithm is confident about you, not when you are confident about yourself.

And most of the questions do not reward the most secure-sounding answer. They reward the answer that fits the constraint in front of you.

That is why the credential means something.

Passing the CISSP does not prove you memorized a book.

It proves you can hold eight domains in your head at once, read a scenario for what it is actually optimizing for, and make a defensible call under time pressure with no ability to second-guess yourself.

It is a judgment exam wearing a knowledge exam costume.

Basically, the everyday life of a Chief Information Security Officer.

The Part Nobody Puts On LinkedIn

In 2024 I joined a global bank as a Principal Security Architect. My manager mentioned the CISSP as a performance stretch goal. Some of my teammates had it.

So I bought the study guide and started contemplating.

In 2025 I made it a goal to sit for that exam. I did not achieve it.

The work that year was very demanding. My health took a good stretch of my attention that year. Life did what life does.

In early 2026 I said to myself “this is the year.” I opened Chapter One.

Security and Risk Management pulled me in immediately and quietly rewired how I think about risk, which matters more to my day job now than I expected.

Chapter Two on asset security was even better. Classification, categorization, data protection. I loved it.

Then I hit Domain Three.

Security models. Bell-LaPadula. Biba. Read up, write down, and the inverse. I froze. I read the same pages more than once and they would not stick.

So I put the book down.

March. April. May. Almost into June. Three months of nothing.

That is the part that typically does not make the LinkedIn certification announcement post.

Passing the CISSP looks like a straight line from the outside. From the inside it was a stall that lasted a season.

July 5

Around the Fourth of July I sat down and took stock of the year. I had already won my bowling league championship. Mayela and I had taken trips that mattered. 2026 was shaping up to be the year that felt aligned.

And this was the domino that had not fallen yet. The biggest challenge I still had left in 2026.

So on July 5, I wrote it down. I committed to an exam date of July 24. Nineteen days.

I created a contract with myself and I signed it.

Then I did the thing that made it real. I took two weeks of PTO to strictly focus on this one goal.

Two weeks of summer vacation, spent in libraries, bookstores, cafes, and at my kitchen table, while everyone else was at the pool or at Six Flags Great America.

Domain Four in a day. Domain Five in a day and a half. Domain Six in a day and a half. Domain Seven in a day. Domain Eight in a day and a half.

By the Monday night before the exam, I had read and mostly understood all eight domains. It was reassuring to find that most of these topics were not really new to me.

Then came practice exams. I bought a well-regarded set that people who pass this thing consistently recommend. Two hundred dollars. Ouch.

I failed every practice exam I took.

Four attempts. Four failures. Three days out.

Panic ensued.

I was seriously considering rescheduling the exam.

Thank God my wife talked me out of it. Mayela kept pushing me to stick with the plan. She believed the plan was working at the exact moment I had stopped believing it.

That is the only reason I walked into that testing center on Friday.

What I later learned is that the set is designed to hit harder than the real thing, and it works.

It did not teach me content. It taught me stamina. It taught me how to think clearly under pressure.

Sitting still and staying sharp for three hours is a physical skill, and you do not get it from reading a book or watching a YouTube video.

Thursday Night and The Clever Study Hack

The night before the exam, I went back to the thing that had beaten me in March.

Domain Three. Security models and cryptography. I swear I was having nightmares about encryption, keys, and digital certificates.

I built a document of the core concepts I still did not own cold.

Then I fed it to one of my favorite AI tools, NotebookLM, and had it generate a twenty-minute audio deep dive, podcast style, aimed squarely at reinforcing those concepts.

The drive to the testing center was thirty to forty-five minutes. Perfect for my new personalized CISSP Domain 3 Podcast.

I listened to it the whole way there.

I am convinced it earned me questions I would otherwise have lost. At least three or four.

And for the models themselves, I stopped trying to memorize and started using what I already had. Music.

I play guitar. So I turned the security models into a strumming pattern.

Up, down. Biba is integrity. Read up, write down. Bell-LaPadula is confidentiality, and it runs the other way.

The domain that stopped me cold in March became the domain I engineered a creative solution for in July.

That is the whole lesson, if you want it in one line.

I may have to use Suno to turn this hack into my next AI-produced musical hit.

Here’s my first AI musical hit, if you haven’t heard it yet: Quiet Builder.

The Day of the Exam

I did all the diligent things any good test-taker should do.

I had a good night’s sleep. I ate a big breakfast two hours before the exam so my grumbling stomach wouldn’t ruin my concentration.

I relaxed.

I prayed at home. I prayed in the car. I prayed in my seat before the first question loaded.

I had done everything I could do. The rest was not mine to carry.

I paced for 150 questions, roughly seventy seconds each. Some took fifteen seconds. Some took about two minutes.

I expected it to end around 125, the way many CISSP test-takers describe it.

Mine went all the way to 150.

At question 147 I had about two minutes left. I have watched playoff games with less tension in them. I answered the last question with roughly fourteen seconds on the clock.

Talk about cutting it close.

Then came a survey. Then a message telling me to see the proctor. No results yet.

That five-second walk to the proctor’s desk was the longest short walk of my life.

That is when I received the folded paper. You already know what happened next.

I may have teared up just a wee bit. You will never know, since you weren’t in that restroom.

One thing I want to pass along to anyone who walks out of that room trying to read the tea leaves. There are none.

Going the full 150 is a neutral signal. It means the algorithm never reached confidence in either direction. People pass at 150 and people fail at 150. Do not spend the drive home decoding it. I did, and it taught me nothing.

Passing the CISSP came down to the last fourteen seconds on the clock, and I had no idea until I unfolded that paper.

Where This Goes Next

The certification is not the destination. It is a foundation.

My work sits at the intersection of AI and security governance, in a regulated environment where the stakes are real and the guardrails are still being written. 

That field does not need more opinions. It needs practitioners who can show their work.

Passing the CISSP gives me a defensible floor to stand on. 

It formalizes the security fundamentals underneath everything I am building. 

Risk. Asset protection. Architecture. Identity. Assessment. Operations. 

Those do not become obsolete because there is a model in the loop. They become more load-bearing.

The direction from here is the same as it was. Govern the AI. Prove it in The Build Lab.

Keep a Human at the Helm.

The floor is just firmer now.

What Resilience Actually Looks Like

I want to be careful here, because resilience gets sold as a personality trait. It is not.

Resilience looked like putting the book down for three months and picking it back up.

It looked like failing four practice exams in a row and walking into the real one anyway.

It looked like giving up two weeks of summer.

It looked like going back to the exact thing that had defeated me and refusing to leave it undefeated.

None of that is heroic. All of it is available to you.

Passing the CISSP did not require a different kind of person. It required the same person, showing up again after deciding not to.

If there is something you have been circling for years, something you filed under someday because it looked like a mountain, this is what I have to offer. 

The mountain does not shrink. You just decide to start, and then you keep starting, over and over, on the days it would be easier not to.

Thank You

To my manager, who mentioned this certification to me and encouraged me to go after it. That nudge is the reason the goal existed at all.

And to my incredible wife, Mayela. I love you so much!

You told me I could do this every single time I said I could not. 

There were more of those times than I want to admit. 

You were fine with me spending two weeks of vacation buried in a book. 

You talked me off the ledge three days out when I was ready to walk away from the date. 

You studied alongside me in those cafes, working toward your own exam, and you made the hardest two weeks of the year feel like something we were doing together.

I passed this. We earned it.

All glory and honor belongs to God.

If you are somewhere in the middle of your own long climb, whether it is a certification exam, a challenging project, or anything hard, remember this:

There is a lot more inside you than what you realize.

This is what the CISSP exam taught me about human resilience.

P.S. That bio below still says I am “pursuing” the CISSP. Not anymore. Once the endorsement clears, I get to delete that word for good.