Logo
Cybersecurity

Cybersecurity Careers Should Start Before University

If students first discover cybersecurity when they’re applying for jobs, we’ve already lost several useful years.

ITSEC AsiaITSEC Asia
|
Sep 07, 2026
Cybersecurity Careers Should Start Before University

Ask a teenager what jobs exist in technology and you’ll probably hear programmer, software engineer or perhaps data scientist. Ask about cybersecurity and the picture can become considerably fuzzier. Maybe “hacker” makes an appearance, usually wearing an imaginary hoodie.

That perception matters because Indonesia needs a much larger pool of people who see cybersecurity as a realistic career before they have to choose one.

Komdigi has started pushing cybersecurity education further down the talent pipeline. In May, its Digital Human Resources Development Agency provided Basic Cyber Security training to 124 students at SMKN 2 Depok, covering digital security awareness and preparation for a technology-driven workplace.

The direction is also appearing internationally. NIST’s NICE program updated its September webinar on 2 September with a specific focus on preparing students for future cyber careers. One part examines how K–12 education can introduce skills connected to immediate workforce realities such as cloud security and generative AI.

Cybersecurity education is moving earlier because the work itself isn’t waiting.

Exposure Before Specialisation

Starting earlier doesn’t mean asking 15-year-olds to become penetration testers before their next mathematics exam.

The first objective is exposure.

Students can begin with concepts that make cybersecurity tangible and show them what the profession actually involves:

  • How networks and digital identities work
  • Why systems become vulnerable
  • How phishing and social engineering manipulate people
  • What happens during a cyber incident
  • How defenders investigate suspicious activity
  • Why cloud and AI systems create different security questions

Once students understand the problems cybersecurity professionals solve, the career becomes less abstract.

Indonesia already has a natural entry point through vocational education. Komdigi’s Vocational Blended Learning program has also been assessing SMK students against SKKNI-based competencies. During June alone, 99 students from six vocational schools in Bekasi participated in competency certification across several digital disciplines.

The Gap Between Knowing and Doing

Exposure, however, eventually has to become practice.

A student can memorize what phishing is in roughly the time it takes to finish a cup of coffee. Recognising a convincing phishing attempt, investigating where it came from and deciding what to do next requires a different kind of learning.

That’s why practical environments matter as students progress. Labs, simulations, competitions and cyber ranges allow learners to turn concepts into observable skills.

Komdigi made a similar point when supporting the Country-to-Country Capture the Flag competition in Bali in August. The event brought together 81 participants from 13 countries to test technical abilities against cybersecurity scenarios rather than simply discuss them.

The talent pipeline becomes stronger when those experiences connect: early exposure creates interest, structured learning builds foundations and realistic practice develops capability.

That progression is also relevant to ITSEC Cyber & AI Academy. Practical cybersecurity and AI training can provide the next step for learners and professionals who need to turn foundational knowledge into skills they can use in real working environments.

Indonesia needs millions more digital talents by 2030. Waiting until people enter the workforce before introducing cybersecurity makes that challenge unnecessarily harder.

Sometimes the first cybersecurity lesson needs to happen while there’s still a school bell at the end of it.

Explore practical cybersecurity and AI training at ITSEC Cyber & AI Academy.

References: Komdigi: Basic Cyber Security Training for SMK Students, 21 May 2026 · NIST NICE: Preparing Today’s Students for Tomorrow’s Cyber Careers, updated 2 September 2026 · BPT Komdigi: Vocational Blended Learning Certification, 3 July 2026 · Komdigi: C2C-CTF 2026

Share this post

You may also like

Supply Chain Attacks Are Growing: Why Third-Party Risk Needs Continuous Testing
Cybersecurity

Supply Chain Attacks Are Growing: Why Third-Party Risk Needs Continuous Testing

Introduction Third-party involvement in data breaches doubled from 15 percent to 30 percent in a single year, the largest one-year shift ever recorded in the Verizon 2025 Data Breach Investigations Report. That is not a gradual trend line, it is a structural shift in how attackers reach their targets. Rather than breaching a company directly, they go after the vendor, the software dependency, or the service provider sitting quietly inside that company's trust boundary. As Indonesia's leading cybersecurity company, ITSEC Asia works with organizations across finance, healthcare, and technology who are only now realizing that their own defenses were never the whole picture, because a breach can start three vendors away and still land squarely on their desk. Source: Supply Chain Attack Statistics 2026, Stingrai Research · Supply Chain Attack Statistics for 2026, Swif The Numbers Behind the Shift A supply chain compromise now costs an average of 4.91 million US dollars and takes 267 days to identify and contain, the longest lifecycle of any breach vector tracked in IBM's Cost

ITSEC AsiaITSEC Asia
|
Jul 31, 2026 — 4 minutes read
The Vulnerability May Be Inside Software You Already Trust
Cybersecurity

The Vulnerability May Be Inside Software You Already Trust

On 9 November, Cisco updated its security advisory covering vulnerabilities in Node.js and the Brotli compression library. The revision changed the list of Cisco products under investigation, products with fixes available and products confirmed not vulnerable. Cisco also disclosed that proof-of-concept exploit code exists. Its Product Security Incident Response Team said it was not aware of malicious use of these vulnerabilities against Cisco products. [1] The update concerns CVE-2026-111497, an out-of-bounds write in the Brotli decoder. Brotli compresses web content such as HTML, CSS and JavaScript so it can move across networks using less bandwidth. The flaw appears when a vulnerable decoder processes specially crafted compressed data. Depending on the affected application and how it handles that input, the result can include memory corruption, a crash, disclosure of sensitive memory or potentially arbitrary code execution. [2][3] The vulnerable upstream releases are Google Brotli 1.0.3 through 1.2.0. Fixed releases are 1.0.10, 1.1.1 and 1.2.1. Node.js also issued fixed releases for its supported 22.x, 24.x and 26.x lines on 21 October. [3][4] CISA

ITSEC AsiaITSEC Asia
|
Nov 10, 2026 — 4 minutes read
7 Main Criteria for Quality Managed Security Services Providers That Every Company Must Know
Cybersecurity

7 Main Criteria for Quality Managed Security Services Providers That Every Company Must Know

INTRODUCTION Cyber threats no longer wait for companies to let their guard down. Attacks occur at any time, across sectors, and are increasingly difficult to detect without an integrated monitoring system. According to Gartner, 90% of non-executive board members have no confidence in the value their organizations receive from cybersecurity investments, a gap that continues to widen between leadership expectations and internal team capacity. This is where Managed Security Services (MSS) plays a role. However, not all service providers offer equal protection. Many companies only realize the weaknesses of their vendors when an incident has already occurred. This article discusses seven criteria that should serve as an evaluation reference before you sign a contract with a Managed Security Services provider. Source: gartner.com [http://gartner.com], issglobal.com [https://issglobal.com/perspectives/what-are-managed-security-services/] WHY CHOOSING THE RIGHT MSS IS CRITICALLY IMPORTANT? Throughout 2024 to 2025, companies in the healthcare, automotive, financial, defense, and technology sectors experienced major breaches that cost billions of dollars in losses, exposed millions of data records, and paralyzed operations for months. The pattern found is quite alarming: these

|
Apr 30, 2026 — 6 minutes read

Receive weekly
updates on new posts

Subscribe