Does AI Threaten Entry-Level Cybersecurity Jobs?

Three AI models scored 150 out of 150 on the CISSP exam I wrote. Here's what that means, and doesn't mean, for your first cybersecurity job.

Last week, I tested whether an average AI model can pass the CISSP exam-style questions I created. As we now know, all three tested models scored 150/150.

I Tried to Make AI Fail the CISSP Exam. It Scored 100% Every Single Time.

Not one wrong answer.

If you’re trying to break into this field, that number probably hit you in the stomach.

You’ve spent months studying. Maybe you paid for courses. Maybe you’re about to spend €700+ on an exam. And a free chatbot just answered every question perfectly.

So the thoughts start:

Why would anyone hire me when AI already knows all this?
Am I preparing for a job that won’t exist in two years?
Should I even keep going?

I get it. And I’m not going to tell you the fear is stupid, because part of it is real.

But most people are panicking about the wrong thing.

Let’s separate what you should actually worry about from what you shouldn’t.

What you can expect from this article

• Why passing an exam and doing the job are not the same test

• What AI actually changed about entry-level hiring, and what it didn’t

• The one skill that got more valuable, not less, because of this

Why I think AI passed so easily

Look at how an exam question is built.

A clear scenario.

Four options. Multiple technically correct answers, but only one BEST answer. Everything you need is inside the question somewhere.

That’s exactly what AI is built for. That’s where it thrives.

Now look at the same situation at work.

Exam version:
“A user reports a suspicious email requesting an urgent wire transfer. What should the security professional do FIRST?”

Real version:
A Slack message from the CFO’s assistant. It has a screenshot, not the original email. The CFO is on a flight. Finance wants to pay the invoice today because the vendor is “critical.” And nobody knows if this vendor changed banks last month.

AI answers the first one in two seconds.

The second one has no four options. Nobody tells you what the question is. You have to:

• Figure out what you’re actually looking at

• Work out what’s missing and who has it

• Decide what matters more: stopping the payment or keeping the business running

• Explain your decision to people who don’t care about security

The exam tests whether you know the answer. The job tests whether you can figure out what the question is.

So let’s stop confusing passing an exam with being a good cybersecurity professional.

So, should you panic or not?

So am I saying that you shouldn’t be worried? Not really.

The whole industry is changing, there is no doubt about that.

Pretending otherwise would be lying to you.

Some tasks that used to fill a junior’s week now take minutes:

• First drafts of policies and procedures

• Explaining what a log line or alert means

• Summarizing a CVE

• Writing a quick script to parse a file

• Answering “what does this acronym mean?”

If your plan was to get hired to do only these things, you have a problem.

But in my personal opinion, if you’re reading this, that was never your goal.

On the other hand, thanks to AI, the number of attacks is increasing rapidly. So many vulnerabilities can now be exploited basically for free.

And that also means you need more and more people who continue to monitor your network.

Yes, AI helps analysts spot anomalies. But anyone who has ever run a SIEM or XDR knows the tool doesn’t make the call. You still need an analyst who can decide whether an alert actually matters.

And that’s the pattern. AI changed the tasks. It didn’t change who’s responsible:

• Someone has to own the risk: “The chatbot said it was fine” doesn’t pass an audit.

• Someone has to know the environment: AI doesn’t know your undocumented legacy server.

• Someone has to check the output: A fluent wrong answer is more dangerous than an obvious one.

The skill that just got more valuable

For years, knowledge set you apart. Ports, frameworks, acronyms.

Now answers are free. What’s scarce is the ability to judge them.

And you can’t judge what you don’t understand.

Say AI tells you to block an IP that’s generating strange traffic. It’s confident. It even writes the firewall rule for you.

But what if that IP is your own email gateway? Or a partner integration finance depends on?

Plausible answer, but completely wrong for your environment.

The junior who catches that gets hired. The one who copies and pastes it is a liability.

So remember: AI doesn’t make fundamentals less important. It makes them even more important.

The real question

This brings me back to one of my past ideas: entry-level cybersecurity jobs don’t really exist.

Entry-Level Cybersecurity Jobs Don’t Exist -Here’s Exactly What to Do Instead

Even junior cybersecurity roles expect experience in IT or another relevant field.

So maybe the real question isn’t whether AI will take entry-level cybersecurity jobs.

It’s whether AI can take something that may never have existed in the first place.

The path in was always the same: build real fundamentals, then move into security. AI didn’t change that. It just made skipping them far more difficult.

Want a step-by-step plan for your first role? The 90-Day Cybersecurity Job Blueprint shows you what to learn, what to build, and how to prove it to employers, week by week.

Conclusion

I don’t think AI is coming for entry-level cybersecurity jobs. I think it’s coming for the version of the job that was already the weakest way to break in: pure recall, no judgment, nothing you actually built yourself.

That’s not a reason to panic. It’s a reason to stop preparing for a job that was disappearing anyway, and start preparing for the one that’s actually available.

If you’re trying to figure out exactly which path to prepare for and what to actually study first, that’s precisely what the 90-Day Cybersecurity Job Blueprint walks you through, path by path, without wasting a year on the wrong certifications.

Tell me in the comments which role you’re aiming for (SOC, GRC, cloud, or something else). I’ll reply with the one fundamental I’d go deep on first.

Let’s Connect

If you want to collaborate, discuss, or just geek out over networking and cybersecurity, reach out:

Email: erich.winkler@decodedsecurity.com
LinkedIn: Erich Winkler
Gumroad community: Decoded Security
Start Here: Decoded Security Roadmap

Enjoyed this article? Like it or drop a comment. I’d love to hear your thoughts and questions!

Let’s learn and grow together!