Training decays; formats compound
Every training program faces the same physics: two weeks after the last session, usage drifts back toward old habits. At the ~300-person cybersecurity company where Node8 runs its enablement program, the countermeasure is a small set of recurring formats that turn adoption from an event into a routine. They cost a few hours a week and have generated most of the program’s visible wins.
Format 1: AI Office Hours (weekly, ~60 minutes)
An open weekly call for the whole engineering organization — routinely around 50 attendees. The agenda is simple and repeatable:
- Engineer demos. Two to four short presentations of AI workflows built since last week.
- Live unblocking. Anyone stuck on a tool, permission, or workflow problem brings it to the group.
- Program announcements. Competitions, deadlines, new shared assets.
- Feedback vote. A quick form after each session — which demos were most useful — keeps content quality honest and tells facilitators what to schedule more of.
What makes it work is that the demos are real work, not show-and-tell. A sample of what engineers actually presented over a few weeks:
- A release-status skill that verifies release steps and aggregates data from CI (TeamCity) and GitHub into one report.
- An environment-setup skill that automates developer environment provisioning over the team’s Terraform setup.
- A requirements-compliance skill that audits tickets and design files against the PRD and flags discrepancies before code gets written.
- A test-failure analysis skill that aggregates logs across systems to diagnose failing builds.
- A network-troubleshooting skill that cut a support-engineering analysis task from hours to minutes.
- A CVE triage skill — built live in a session — that checks severity scores and patch status against vulnerability databases.
- A design-to-ticket workflow using a Figma MCP integration to generate structured Jira tickets from design frames.
Format 2: AI Working Sessions (all-engineering, thematic)
Where office hours are individual and demo-driven, working sessions take one theme and work it with the whole group for an hour. Recent themes from this engagement:
- The failure modes of AI-generated code — unwanted dependency additions that broke audits, code duplication from limited context, environmental assumptions that hurt stability — and the countermeasures, like CLAUDE.md policies requiring human approval for new dependencies.
- AI-generated testing — using agents to expand coverage, with conventions files driving test style and humans owning the audit.
- What is a skill, and how do you build one — a live build of a CVE triage skill, from markdown definition to scripts, in front of the group.
- Managing agent sessions at scale — interruption, parallel sessions, background tasks, and the shift from pair-programming to task queues.
The output of a good working session is a shared practice, not just a discussion: a policy in the repo, a convention file, a template others copy.
Format 3: The skills competition
The single best engagement lever in this program was a lightweight competition: teams sign up via a form, build a skill that encodes company-specific knowledge into an automation, and demo it in five minutes on a scheduled demo day, with an overflow work session the day before for finishing touches. It converted passive attendees into builders, and its artifacts outlive it — every entry lands in the shared repository.
Who attends, and why that matters
Attendance is broad by design: senior engineers, juniors, support engineering, QA, and — importantly — engineering leadership. Leadership presence signals that this is work, not extracurricular. The sessions are also where the program’s facilitators (Node8 plus the client’s program owner) take the temperature: which teams are quiet, which regions are missing, where language or time zones are filtering people out. Several midpoint course corrections — Spanish-language support, vacation-aware scheduling — were first spotted as attendance patterns in these calls.
Questions are the real telemetry
The questions engineers bring to office hours are the most honest signal in the whole program. “How do I stop the agent from adding dependencies?” is a governance gap. “How do I run two sessions in parallel without losing track?” is a workflow-maturity milestone. “Can it read our test-management system?” is an integration request. Facilitators treat every question as a data point and triage it into one of three buckets: answer now, turn into a working-session theme, or add to the automation backlog.
From sessions to an automation backlog
The compounding mechanism is deliberate:
- Demos and questions surface candidates — anything demoed once, or asked about twice, is a candidate automation.
- A central skills repository collects every skill so wins stop living on one engineer’s laptop. Getting people to move from local experiments to the shared repo took explicit, repeated pushes — transparency is a habit you install.
- Action items carry between sessions. Each session ends with named owners: merge that PR, template that output, extend that integration.
- The best candidates graduate into standardized team workflows in the engineering track — and into the metrics story leadership reports on.
Over a couple of months this produced a genuine internal automation library: release reporting, environment setup, test triage, vulnerability triage, design-to-ticket — each one demoed, hardened by feedback, and reusable by any team.
Work with Node8
Node8 designs and facilitates these formats as part of its AI enablement programs — the case study is here. If your AI adoption spiked after training and then flatlined, the fix is usually format, not content. Talk to us.