Fields / Digital / Everywhere
Cybersecurity / InfoSec
First stop
What this field is
Every system connected to a network is a system someone is trying to break into. Cybersecurity is the field that stands between the attacker and the system, the vulnerability and the breach, the data that exists and the data that gets stolen.
The structural pull at the field level is Protection. Whatever a particular security role looks like — a SOC analyst watching dashboards at three in the morning, a penetration tester probing a client's network for weaknesses, a security engineer hardening a cloud environment, a CISO presenting risk posture to a board of directors — the field exists because the move from vulnerable to safe requires sustained, skilled, adversarial attention. The threat does not sleep, does not take weekends, and does not care about your staffing budget.
Discovery is the offensive face of the field. Penetration testing, red teaming, vulnerability research, and threat hunting are all Discovery work — finding what is wrong before an attacker does. The structural similarity to investigative work is not a metaphor; the penetration tester is asking the same question as the detective: what is here that nobody has noticed yet? The difference is that the detective works after the fact and the pen tester works before. The people drawn to this side of the field are drawn to the hunt — the intellectual pleasure of finding the gap, the path, the overlooked assumption. The ethical dimension is real and unusual: the same skills, tools, and mindset that make a great penetration tester would also make an effective attacker. The field exists in a permanent structural tension between the offensive and defensive applications of the same knowledge.
Resolution is what happens after Prevention and Discovery fail — which they do, regularly. Incident response is the crisis mode of cybersecurity: a breach has occurred, the attacker may still be inside the system, data may be exfiltrating in real time, and a team of people has to simultaneously contain the breach, preserve forensic evidence, restore operations, and communicate with leadership about what happened and what it means. The tempo signature of incident response is Surging — compressed, high-stakes, sleep-disrupting. Most cybersecurity professionals will tell you that the first major incident they worked fundamentally changed their understanding of what the job actually is. The gap between "we monitor for threats" and "we are currently being attacked and need to act in the next forty-five minutes" is the gap between the field's resting state and its operational reality.
Revelation runs through the forensic and analytical layer. A security analyst reading logs, a forensics investigator reconstructing a breach timeline, a threat intelligence analyst decoding an adversary's infrastructure — each is doing Revelation work. The data is there; the job is to see what it means. The ability to read a log file and notice the one anomalous entry in ten thousand normal ones is a perceptual skill that develops over years of practice and is not well captured by certifications or academic credentials.
The field has a genuine and persistent labour shortage. There are more open security positions globally than there are qualified people to fill them, and this has been true for over a decade. The entry path is unusual compared to most professional fields: formal degrees in cybersecurity exist but are neither required nor always respected by practitioners; certifications (CISSP, CEH, OSCP, CompTIA Security+) carry significant weight and in some cases more weight than a university degree; and many of the field's most respected practitioners are self-taught or came from adjacent fields (systems administration, software engineering, military intelligence). The honest version of the field for a prospective entrant: the demand is real, the work is genuinely important, the entry paths are wider than most fields — and the lifestyle costs, particularly the on-call burden and the burnout rate in security operations roles, are significant and should not be romanticised.
The pull
Protection
Vulnerable → Safe
The pull to shield from harm
Discovery is the offensive face of the field.
Discovery
- Penetration testing
- red teaming
- vulnerability research
- threat hunting
The line forks
5 ways in
Service update
What AI just changed
What is newly possible in Cybersecurity / InfoSec, what stays yours, and how AI is changing the way in. In that order, and only if you want it.
Barriers that dropped
3 barriers have dropped
A solo consultant serving mid-market clients at specialist-firm scaleInference
A solo cybersecurity consultant competing for mid-market clients was constrained by throughput: compliance gap analyses, policy drafting, and vulnerability assessments each required significant manual work, making it difficult to serve multiple clients simultaneously at the quality level required to sustain a practice.
LLM-assisted policy drafting, AI-enhanced vulnerability scanning, and automated compliance reporting dramatically reduce per-engagement production time. A solo consultant with strong AI tool fluency can now deliver at the throughput of a small team. The judgment work — scoping, remediation prioritisation, client communication — remains entirely human; AI assists the production, not the strategy.
Very likely to keep going this way. How far it goes is uncertain: no workforce figures yet show solo consultants keeping up the output of a firm, and scoping the work and judging what clients need still take a person.
This is our reading, not a measured figure. It draws on what AI has done for solo lawyers and on security consultants' documented use of AI tools. No workforce data measures it yet.
A single security generalist covering what used to need a full teamInference
Security expertise was so specialised and broad that a single person could not credibly cover threat monitoring, penetration testing, compliance, and incident response at a quality level that justified employment by a mid-market company. Most mid-market companies either outsourced to MSSPs or went without.
AI-enhanced tools (AI-native SIEM, automated compliance platforms, AI-assisted pen testing) extend what a single skilled security professional can monitor and manage. A security generalist with strong AI tool fluency can now maintain defensive posture for an organisation that previously had to choose between MSSP cost and security risk. AI tools are partially compensating for the talent gap rather than replacing existing talent.
Very likely to keep going this way. How far it goes is uncertain: no workforce data backs it yet, and one person covering every area is least tested while responding to a live security incident.
This is our reading, not a measured figure. No workforce data yet counts security generalists working this way with AI, though people in the security community describe it happening.
Threat intelligence becoming an accessible independent practiceInference
Threat intelligence — tracking adversary groups, analysing TTPs, producing intelligence products that inform security decision-making — was largely the province of large security vendors, government intelligence agencies, and enterprise security teams with dedicated threat intelligence functions. The aggregation and synthesis burden was too high for smaller practitioners.
LLM tools that synthesise OSINT, structured threat feeds (STIX/TAXII), and MITRE ATT&CK data into actionable intelligence products dramatically lower the production cost of threat intelligence. A practitioner with strong analytical judgment but without a large team can now produce threat intelligence at a quality and frequency that previously required team-level resources.
Very likely to keep going this way. How far it goes is uncertain: there are no figures on uptake yet, and it is untested whether work by independent analysts is good enough to base real decisions on.
This is our reading, not a measured figure. It is based on what AI language tools can do and on how threat intelligence work (tracking and reporting on attackers) is organised.
Jobs that did not exist five years ago
These are real jobs that exist now and did not exist before the current wave of AI. Tap one to see what it is and how well we know it.
Secures AI systems themselves from adversarial ML attacks, model theft, data poisoning, and prompt injection. Distinct from general application security; requires ML system knowledge alongside security methodology. Early practitioners are arriving from security engineering, ML engineering, or research backgrounds.
Named job postings exist for this and adjacent titles; the specialisation barely existed two years ago. One of the clearest 'new role, not a retitled old role' patterns in the PurPassion field set. · current fact
Threat hunter who uses AI to expand the range of environments they can investigate and the speed at which they can form and test hypotheses. The judgement layer — which hypotheses to test, recognising what the AI missed, understanding attacker psychology — remains human; the AI handles data aggregation and initial pattern-matching across large environments.
Configuration is viable today and visible in practice, but has no settled title in postings. Likely to become standard threat-hunting practice within 2-3 years. · early signal
Practitioner specialising in testing AI systems for security vulnerabilities — adversarial prompting, model extraction, data poisoning, inference attacks — alongside or instead of traditional penetration testing. Requires both security methodology and AI/ML model behaviour understanding.
A small and growing specialist community; the natural adjacent path for penetration testers who develop AI/ML system understanding. Likely to formalise into a distinct sub-field as AI system deployments expand. · early signal
The existing CISO role expanding to cover AI risk posture, adversarial-ML exposure, AI ethics and AI-governance compliance (EU AI Act and equivalents) alongside traditional information security governance. Not a new title — a materially widened remit under the old one.
CISOs who built this expanded scope early are reported to command premium compensation and board-level authority their predecessors in traditional CISO roles did not have. · early signal
Practitioner who teaches AI-era security skills to the existing security workforce, in formal certification training or internal corporate programmes. Exists because the field's gap has shifted in character from headcount shortage to skills-composition shortage.
ISC2's 2025 reframing from 'workforce gap' to 'skills gap' is the structural driver: the constraint is increasingly that practitioners lack AI-era security skills, not that there are too few practitioners. · early signal
Only the AI Security Specialist is confirmed as a hired-for title with postings. The other four are role configurations inferred from structural trajectory and practitioner-community signal; they are graded accordingly and should not be read as documented labour-market facts. Novelty assessments for configurations without settled titles are provisional.
What stays yours · where AI reaches
Bars above the line are the parts of this work that still need a person. Bars below it are what AI can already do. Tap any column to see the actual work behind it.
The honest read. Cybersecurity is protected by an unusual combination: almost no physical protection and no licensing floor, but exceptionally strong creative-synthesis and ambiguity-navigation protection derived from the field's adversarial structure. Because the opponent adapts, the highest-value work has no stable pattern to learn from — which is precisely the condition under which current AI tooling is weakest. The practical consequence for a student is that the protection is concentrated at the top of the skill distribution rather than spread evenly: the routine, high-volume, pattern-matching end of the field (Tier 1 triage) is the most exposed work in the corpus, while the creative-adversarial end is among the least. This is the opposite of a field like veterinary science, where protection is broad and structural.
Cybersecurity is the only field in the PurPassion set where AI deployment on the attacker side is not only real but documented at the nation-state level. This makes AI adoption by defenders non-optional in a way that is structurally different from every other field: the question is not 'should we use AI tools' but 'how quickly can we match what attackers are already deploying.'
How AI is changing the way in
5 ways into this field, and AI is not doing the same thing to each of them.
- Security Analyst / SOC — Tier 1Harder to enter
The highest-volume, most AI-tractable tasks in the field's widest entry ramp are under direct pressure from AI triage tooling. Vendor-published deployments report investigation time falling from 30+ minutes to under 2 minutes per alert; a SOC that needed 10 Tier 1 analysts to process a shift's alert volume may need 3-4 for escalation and oversight. Entry-level headcount growth at Tier 1 is expected to lag total security hiring growth. [reported by people in the field for the time-reduction magnitude — vendor case studies, not independently audited; inference for the staffing-ratio consequence]
- Security EngineerSlightly harder to enter
AI-assisted code review and infrastructure scanning compress some junior production work, but security engineering entry has always required a software or infrastructure foundation rather than being a high-volume execution role. Augmentation dominates displacement. [inference]
- Field aggregate — all security hiringSlightly harder to enter
The field's decade-long structural shortage absorbs AI efficiency gains into expanded capacity rather than headcount reduction: AI tools are helping the existing workforce handle more threat volume, not reducing the number of people needed. Total cybersecurity employment continues to grow. [happening now for the shortage; inference for the absorption mechanism]
- Penetration Tester / Ethical HackerLargely unchanged
Creative adversarial thinking is where AI tooling is weakest. AI has raised the value of skilled human testing by lowering the barrier for unsophisticated automated attacks, so entry-level demand is not under AI pressure. The entry barrier here has always been skill acquisition, not headcount. [our read of how the field works]
- CISO / Security LeaderLargely unchanged
Not an entry-level archetype; reached after a full career. Scope is expanding rather than compressing. Recorded for completeness of the role split. [our read of how the field works]
That is everything we currently know about AI in Cybersecurity / InfoSec. It shows where things are moving so you can choose which way in suits you.
The job market
Getting work in this field
- People and jobs
- Not enough qualified people
- Entry-level jobs
- Growing
- Cost of training
- Worth weighing up
People and jobs. ISC2 2025 (n=16,029): 4.8M global workforce gap. WEF 2026: workforce needs to grow 87% to meet demand. Shortage has persisted for 10+ years. [happening now — ISC2 Cybersecurity Workforce Study 2025; WEF Global Cybersecurity Outlook 2026]
Entry-level jobs. Total cybersecurity employment continues to grow driven by NIS2 compliance demand in E.U., expanding attack surface, and AI threat landscape. Entry-level trajectory for Tier 1 SOC specifically may be stable-to-contracting at individual archetype level even while overall entry-level security hiring grows. [happening now (aggregate) + inference (Tier 1 SOC specific)]
Cost of training. Security certifications (CISSP, OSCP, Security+) carry significant market weight and cost hundreds to low thousands of dollars — meaningful but far below the debt burden of medicine, law, or veterinary science. Bootcamp and self-taught entry paths exist and are used. University degree in cybersecurity or CS is valued but not required. Debt-to-income ratio is favourable relative to other shortage fields.
The cybersecurity labour shortage means AI tools are being deployed to expand existing workforce capacity rather than reduce it — the arms race makes AI adoption non-optional for defenders, but the deployment is primarily additive (one analyst can now cover more ground) rather than substitutive (we need fewer analysts). This is the strongest case in the PurPassion field set for 'AI amplifying the existing workforce' rather than 'AI replacing the existing workforce.'
Interchange
Change here for
People drawn to Cybersecurity / InfoSec are often drawn to these.
End of the line
That is a conversation about this field, not a test. Or keep going on your own. Both doors stay open.