Information Security Matters: Artificial Intelligence and Entry-Level Cybersecurity Jobs

There are 3.5 million unfilled positions in cybersecurity, globally.¹ No, wait; the workforce gap is 4.8 million jobs.² Or maybe the shortage is four million cyberprofessionals.³ Does it make anyone feel better if the actual number is 2.8 million unfilled positions worldwide?⁴ I think it is safe to surmise that no one knows the exact number, but there are a lot of openings for cybersecurity professionals.

Potential Uses of AI in Cybersecurity

To a certain extent, artificial intelligence (AI) may ease this shortage. There are many aspects of cybersecurity that may be aided or performed by AI. Some possibilities include:

• Differentiating actual attacks from false alarms found in monitoring data
• Deterring phishing and other suspicious activity in emails and texts
• Simulating social engineering attacks
• Assimilating and analyzing incident-related data
• Making penetration tests easier to perform⁵

Note that these are the types of activities that are often performed by entry-level staff, or at least those who arrive from college with degrees in computer science. They involve monitoring information systems (and AI systems for that matter) for potential theft of data or even for destructive attacks such as ransomware. Based on my own background in recruiting employees from colleges and universities, I found there were also many students who were already adept at ethical hacking; they started doing so (maybe not quite so ethically) well before their freshman years. Thus, I ask, what are the opportunities today for young people in the cybersecurity field, if AI can do the job?

Shortage of Entry-Level Cybersecurity Jobs

The available statistics—and there are not many—do not paint a sunny picture of entry-level positions. However, there is clearly a need for experienced personnel in cybersecurity. The reported disparity between qualified candidates and unfilled job openings makes this clear. Those with demonstrable skills have numerous opportunities for employment. Those without face much greater competition for fewer spots. An indicator of experience is certification, since most certifying bodies, including ISACA^®, require actual experience as well as success on an examination. Figure 1⁶ illustrates the gap.

Note that only for entry-level personnel does the supply outstrip the demand. There is no way to tell whether or to what extent AI is creating this gap, but it surely is not helping young applicants. AI is likely to make things harder for them in the future.

The Case for AI

I can understand the relative dearth of entry-level cybersecurity positions from the perspective of an employer. Recent graduates have potential but, except in rare instances, do not have achievements.

Their salaries are investments in what they will do, not rewards for what they have done. It is often the case that by the time they have begun to realize their potential, their salaries are less than their market value as somewhat experienced cybersecurity professionals. If they leave for larger paychecks, the return on the investment made in them is negated.

However, acquiring AI tools to do the same work as a new hire could pay immediate dividends. The AI systems can be trained to perform cybersecurity tasks well beyond the capability of inexperienced beginners. Sure, AI systems make mistakes, but so do human beings, particularly those who are just learning their craft. Even if AI security products are not eliminating opportunities at scale today, there is a high probability that they will in the future.

Judgement

To summarize, entry-level jobs in cybersecurity are hard to find and AI will most likely make it harder. Chief information security officers (CISOs) and IT managers are having a more difficult time finding experienced personnel with, say, five years of experience, enough to become certified. So where will personnel with the necessary experience come from five years hence? AI might ease the labor shortage in the short term, but it will exacerbate the problem because of what AI does not have and what cybersecurity programs need: judgement.

The issue of AI’s judgement capability is rife with controversy. The preponderance of the literature I have read says that “AI doesn't do judgement.”⁷ Then, there are some who see AI mimicking human judgement,⁸ but I have not read any that say forthrightly that AI systems exhibit judgement in the sense that we mere humans generally mean it. Cybersecurity professionals need to be able to distinguish actual attacks from false positives and false negatives, but as ChatGPT describes itself, AI “does not have consciousness, emotions, or personal experience, so its “judgment” is not subjective in the human sense” (emphasis added).

Opening Opportunities

Opening opportunities for beginners in cybersecurity is a difficult problem but not an intractable one. I believe that a triad of students, employers, and cybersecurity roles can ease career entry in cybersecurity. In my opinion, several things need to be done:

• Students who intend to have careers in cybersecurity should obtain degrees in that specialty. There are numerous colleges and universities that offer baccalaureate programs in cybersecurity, in addition to or along with computer science. It is not that studies at this level prepare students to be experts (whatever that means) once they put mortarboards on their heads. But academic training can make a new employee more adept more quickly, thereby giving the employer greater value sooner.
• The definition of cybersecurity should be expanded to include more subspecialties. I suggest that the ethics of information technology, especially including AI, is a fit subject for cybersecurity professionals. There is more to cybersecurity than simply keeping the bad guys out of systems. There are decisions to be made about the acceptable use of information, beyond preventing unacceptable use, that need judgement that, as I say, AI does not have.
• Forensics and the preservation of the chain of evidence are also applicable to cybersecurity. The people who study forensics usually get training in “biology, molecular biology, chemistry, biochemistry” as well as forensics itself.⁹ Note the absence of information technology in this list. There is a clear need for IT-knowledgeable people, in both security and investigative functions, which may merge into one field with regard to detection and prosecution of cybercrimes.
• Employers should accept the fact that not everyone they hire—especially those right out of school—will stay with their organizations until they retire. To be fair, most recruiters already know this. After all, CISOs may well have come from somewhere else, so how can young employees be faulted for seeking other, if not necessarily greener, pastures? Managers should seek to maximize the contributions of entry-level personnel while they are employed and provide them with salaries commensurate with their worth. To keep these young people as their skills increase, they should be offered career paths not only upward in cybersecurity but into other sectors of an enterprise. Interests and expectations change over time; career alternatives should be offered as well as advancement.

Endnotes

¹ Morgan, S.; “Cybersecurity Jobs Report: 3.5 Million Unfilled Positions In 2025,” Cybercrime Magazine, 14 April 2025
² ISC2 Research, “Employers Must Act as Cybersecurity Workforce Growth Stalls and Skills Gaps Widen,” ISC2, 11 September 2024
³ World Economic Forum, “Bridging the Cyber Skills Gap”; The World Economic Forum article is undated, but it is referred to in an article in Forbes, dated August 2024. Kelly, J.; “Nearly 4 Million Cybersecurity Jobs Are Vacant: Here’s Why You Should Consider Breaking Into This Sector,” Forbes, 16 August 2024
⁴ Global Cybersecurity Forum and Boston Consulting Group, 2024 Cybersecurity Workforce Report: Bridging the Workforce Shortage and Skills Gap; Again, this document is undated, but it is referenced in Incyber News. Incyber News, “The Global Cyber Workforce Shortage Deepens,” 25 November 2024
⁵ There is no shortage of security product vendors touting how AI in their offerings can enable higher security effectiveness. This list is drawn from a neutral source, the financial firm Morgan Stanley; Morgan Stanley, “AI and Cybersecurity: A New Era,” 11 September 2024
⁶ Cybersecurity Ventures, 2023 Official Cybersecurity Jobs Report, pp. 11-12, 2023; Note that the report gives the figure of 227,000 people who have been awarded the CEH, but no estimate of the number of open positions. Numerous other sources say the demand is high but likewise do not give an actual number. The graph entry for the CEH contains my best guess.
⁷ Likierman, A.; “Good News For Humans: AI Doesn't Do Judgement,” Think at the London Business School, 14 April 2025
⁸ Kenny, G.; Moser, R.; “How 3 Companies Are Using AI to Mimic Expert Judgement,” Harvard Business Review, 15 November 2024
⁹ Blore, J.; “How To Become a Forensic Scientist,” Forensics Colleges, 29 April 2025

STEVEN J. ROSS | CISA, CDPSE, AFBCI, MBCP

Is executive principal of Risk Masters International LLC. He has been writing one of the Journal’s most popular columns since 1998. Ross was inducted into the ISACA^® Hall of Fame in 2022. He can be reached at stross@riskmastersintl.com.