I definitely think there will be an impact on entry level jobs in cybersecurity, but I also feel that this entry level group is also best positioned to confront this situation, it’s very easy for them to learn AI skills and quickly convert their roles into an AI enabled role, so if someone is targeting to become app security tester and defender, instead of writing own exploits, they can quickly learn to use AI to create the exploits and they spend time in refining the output
But I also think that invariably the number of positions will become less at entry level, because even if everyone has these skills, the number of humans required to do the job will come down. This is definitely the reality
That is a great point that I agree with. People at the beginning of their careers can still adapt at the lowest possible cost.
On the other hand, that requires a certain level of initiative as the “traditional” paths quickly disappear.
I think people at all levels should be aware of one rule: you can’t stop learning if you want to be relevant in the field of cybersecurity. Ever. Once you stop, you’ll be replaced.
I don’t really know where this is going. I’m very sceptical that AI works financially as an industry, and I suspect that in any case it’ll become politically unacceptable long before it becomes technically unstoppable. But on the question of AI replacing low‑level cybersecurity roles, there’s an obvious problem: how can an AI be held responsible if it messes up? Cybersecurity is a risk profession. Someone must be accountable for decisions. AI can assist, but it cannot own a decision. Can it? And will people try to use it to dodge responsibility?
“Ah, yes, the AI did that. Bit moody this week.” "The AI told me to do it. In fact, it insisted."
Where exactly does an AI fit in a responsibility matrix?
More likely is that — just like legacy automation — it lets teams do more with less time. But the roles themselves still need to exist, because otherwise… where do the future leaders come from? Or will they be replaced too in time?
Those are great questions, and I think most companies are trying to answer them right now. Here's what I think, based on my experience.
Someone has to be accountable for the call, and it has to be a person with something actually on the line. An AI can be wrong a hundred times and shrug it off. A person can't. That's exactly why a person still has to be the one making the decision, not just relaying one. And yes, in my experience, "the AI told me to" is already widely used to try to dodge responsibility.
It's possible there will be fewer roles, as companies try to merge existing ones. But I don't think that will work for long. That's why I don't think the roles will disappear. I think the boring parts of them will. There will be fewer people writing first drafts of policies and more people whose actual job is judgment: Is this answer right? Does it fit our environment? Do I actually stand behind this work?
What genuinely worries me more than job loss is this: it's become much harder for juniors to get entry-level experience, because AI eats the "easy" 80% of the job. So I think people at the beginning of their careers might need to change their approach and stop following the "traditional" path.
PS: Where exactly does an AI fit in a responsibility matrix? - NOWHERE!
An interesting side effect of cybersecurity is you need someone (or really, many someones) to be responsible. :)
I agree, that’s a great point Chad. AI has made assigning responsibilities more essential than ever.
I definitely think there will be an impact on entry level jobs in cybersecurity, but I also feel that this entry level group is also best positioned to confront this situation, it’s very easy for them to learn AI skills and quickly convert their roles into an AI enabled role, so if someone is targeting to become app security tester and defender, instead of writing own exploits, they can quickly learn to use AI to create the exploits and they spend time in refining the output
But I also think that invariably the number of positions will become less at entry level, because even if everyone has these skills, the number of humans required to do the job will come down. This is definitely the reality
That is a great point that I agree with. People at the beginning of their careers can still adapt at the lowest possible cost.
On the other hand, that requires a certain level of initiative as the “traditional” paths quickly disappear.
I think people at all levels should be aware of one rule: you can’t stop learning if you want to be relevant in the field of cybersecurity. Ever. Once you stop, you’ll be replaced.
I don’t really know where this is going. I’m very sceptical that AI works financially as an industry, and I suspect that in any case it’ll become politically unacceptable long before it becomes technically unstoppable. But on the question of AI replacing low‑level cybersecurity roles, there’s an obvious problem: how can an AI be held responsible if it messes up? Cybersecurity is a risk profession. Someone must be accountable for decisions. AI can assist, but it cannot own a decision. Can it? And will people try to use it to dodge responsibility?
“Ah, yes, the AI did that. Bit moody this week.” "The AI told me to do it. In fact, it insisted."
Where exactly does an AI fit in a responsibility matrix?
More likely is that — just like legacy automation — it lets teams do more with less time. But the roles themselves still need to exist, because otherwise… where do the future leaders come from? Or will they be replaced too in time?
Hi! Thank you for your comment!
Those are great questions, and I think most companies are trying to answer them right now. Here's what I think, based on my experience.
Someone has to be accountable for the call, and it has to be a person with something actually on the line. An AI can be wrong a hundred times and shrug it off. A person can't. That's exactly why a person still has to be the one making the decision, not just relaying one. And yes, in my experience, "the AI told me to" is already widely used to try to dodge responsibility.
It's possible there will be fewer roles, as companies try to merge existing ones. But I don't think that will work for long. That's why I don't think the roles will disappear. I think the boring parts of them will. There will be fewer people writing first drafts of policies and more people whose actual job is judgment: Is this answer right? Does it fit our environment? Do I actually stand behind this work?
What genuinely worries me more than job loss is this: it's become much harder for juniors to get entry-level experience, because AI eats the "easy" 80% of the job. So I think people at the beginning of their careers might need to change their approach and stop following the "traditional" path.
PS: Where exactly does an AI fit in a responsibility matrix? - NOWHERE!
I liked your pov on this. This is something which we are hearing a lot in mostly all the niches.