Is think like a manager overrated on the CISSP?

The advice is repeated everywhere, but it is no longer consensual. Of the 60 most upvoted candidate reports mentioning the concept, around 23 hold it to be crucial or very useful, around 14 consider it overrated, useless or even harmful, and around 13 offer a qualified version. Among the forty or so success stories that address it, the split is even tighter: a third defend it, a third find it overhyped, a third rephrase it. Nobody disputes that a particular mode of reading is necessary; the debate is about the slogan. The underlying definition is detailed in thinking like a manager on the CISSP.

What has the mantra been criticised for since 2025?

The chronology of the candidate reports is clear. From 2023 to mid-2024, the advice is virtually unchallenged. In late 2024, the shift happens with the rise of the counter-mantra "Just Answer The Question". In 2025 and 2026, the raw version of the mantra becomes a minority position, with explicit labels: overrated, debunked. The line that sealed that reversal has stuck:

Think like a manager works 100% of the time when the question wants that. Otherwise, just answer the question… that works 100% of the time 100% of the time.

It does not reject the mantra: it demotes it to a special case of a more general rule.

Three criticisms dominate. The first is that it diverts attention from technical knowledge. A post with an unambiguous title — "Passed at Q100, 'Think like a manager' is so overrated" — states it in one line.

It may tempt you to ignore technical specifics… DO NOT FALL INTO THIS TRAP.

The second criticism is that it induces overthinking: instead of reading what the question asks, the candidate hunts for a hidden managerial intent. The third is a factual disagreement about the nature of the exam. One contributor estimates that around 70% of his exam was about technical knowledge, and is surprised that so many instructors swear by the mantra. Another adds the most useful qualification in the candidate reports on this point: when people say the exam is not technical, that holds for those who have been practising these technologies for more than ten years.

What do the ISC2 question writers themselves say?

This is the most striking element of these three years of discussion: two contributors presenting themselves as CISSP question writers deny the mantra — self-declared identities, whose weight comes from the consistency of what they say with the rest of the candidate reports.

As an exam writer for the CISSP, I can absolutely say that is NOT what we are looking for. Understanding the concepts and how to apply them, is. To gauge if one can "think like a manager" is definitely not the goal of the exam. That is a completely different exam (CISM).

The second report goes the same way while explaining the illusion:

It is definitely not a "think like a manager" exam. That is not even a concept on our minds when writing them. […] It could feel like you are thinking like a manager. But really, it's because you understood the concepts and could put them into appropriate use.

That last sentence is probably the key to the debate: the mindset would be a perceived effect of conceptual mastery, not a skill assessed in its own right.

How many candidates still defend it?

A relative majority, and with concrete arguments. Of the 60 most upvoted candidate reports, around 23 support it. One candidate quantifies its usefulness: for roughly twenty to twenty-five questions, thinking like a manager was decisive — which, set against an exam of at least 100 questions, describes a useful but partial tool, not a universal key.

The clearest defenders are often those who have watched others struggle. A heavily upvoted comment notes that the mindset strategies are sound and that it is the very hands-on profiles who will struggle most. Several success stories describe the click in the same terms: having stopped reasoning as a technician and started reasoning as someone accountable, and found that the expected answer is rarely "apply the patch".

One cross-cutting observation recurs: governance, risk and compliance profiles find this mode of reasoning natural and therefore have no need of the slogan; very technical profiles find it either a lifesaver or useless.

How could the mantra have made candidates fail?

Two failures are explicitly attributed to it in the candidate reports, through two different mechanisms.

The first is a failure through gaps in knowledge. The candidate built his preparation around the mindset and describes the outcome bluntly.

I was utterly blindsided by questions asking for technical applications of concepts I had never heard of. This wasn't something I could manage my way out of — I ended up miserably failing at Q100.

The second is a failure by overthinking, attributed to the dogmatic use of a mindset resource:

It made me overthink every answer and doubt myself — ultimately contributing to my first failure.

These two reports are individual and prove no general causation. They are enough however to dispose of the idea that the mantra would be, at worst, neutral, and they line up with the most documented causes of failure in the candidate reports, where unbalanced preparation comes up more often than lack of work.

Why do two candidates experience the same exam differently?

This is the most interesting explanation in the candidate reports, and it reconciles part of the disagreement. The adaptive format does not serve everyone the same series of questions: several contributors suggest that it probes each person's weaknesses. A governance profile who answers the risk questions correctly will be pushed towards more technical questions, and vice versa.

Direct consequence: two candidates can describe the same exam as "very technical" and "very managerial" without either of them lying. That invalidates the most common form of the argument on both sides, which generalises a personal experience of 100 to 150 questions to the whole exam. The mechanism itself is described in our article on the adaptive format, and it also explains why so many candidates walk out believing they have failed: a test that looks for your limits makes you hit them.

In which cases does the mindset give the wrong answer?

The candidate reports list several families of counter-examples, all taken from practice banks and not from real questions.

The most frequent case is where the stem explicitly asks for a technical control: looking for a governance answer amounts to not answering the question. Next comes the case of explicit criteria. On an availability question that requires, in so many words, the least expensive solution, the "least risky" reflex leads to the error — one comment puts it this way: you cannot ignore a criterion explicitly stated such as "lowest cost".

Third family: vocabulary questions. When all four options are reasonable but only one belongs to the category asked for — a mitigating control rather than an avoidance control, for example — no mindset can split them. Fourth family: pure knowledge questions, on a phase of the development lifecycle or on the properties of a mechanism. One comment answers them with the phrase that became the counter-mantra: just answer the question.

What should you take away from it in practice?

The practical verdict of the candidate reports comes down to four points, and none of them amounts to adopting or rejecting the slogan wholesale.

First, technical knowledge comes first. Recent candidate reports put the share of questions with a technical basis at between 50 and 70%, individual accounts describing a highly variable share depending on the draw, from 10-20% to around 70% — impressions rather than a measurement, but enough to settle the point at hand: the mindset makes up for no gap in knowledge.

Next, it works as an elimination tool. One contributor explains that he teaches his study group to use it to rule out two answers out of four — the "technical hero" answers, the "direct action" ones and the extreme positions — never to pick the right one.

Third, the question remains sovereign: the persona given, the keywords and the explicit criteria always take precedence over any heuristic. That is the subject of our article on BEST, FIRST and MOST.

Finally, in the event of a genuine tie between two answers, the community has an order of arbitration: its hierarchy of priorities is set out in our article on management reasoning, and the elimination tests that go with it in eliminating the distractors. None of these tie-breakers comes into play as long as a criterion in the stem is still available to settle the matter. As for the resource that did most to popularise the mantra, its record is detailed in our review of the book How To Think Like A Manager.