Cybersecurity Has an Experience Problem. Who Trains the Next Generation?

A familiar contradiction sits at the entrance to many technical careers: employers want experience, but gaining experience requires someone to offer the first opportunity. Cybersecurity faces this challenge while organizations continue to seek people who can protect systems, investigate incidents and manage risk.

The UK's latest government research illustrates the tension. Published on 29 September 2026, Cyber Security Skills in the UK Labour Market 2026 reported a 14% increase in cybersecurity graduates between the 2022/23 and 2023/24 academic years, bringing the total to 7,950. Yet enrolment in cybersecurity-specific apprenticeships fell by 15% between the 2023/24 and 2024/25 academic years. The report also estimated that the UK's cybersecurity workforce grew by only 2% over the preceding year. GOV.UK

More graduates are entering the potential talent pool, but education alone doesn't guarantee that they can step into operational roles. Employers need evidence of practical ability, while newcomers need environments where they can develop it.

The gap between learning and being job-ready

Cybersecurity covers a wide range of responsibilities. A security operations analyst may investigate suspicious activity, while a penetration tester evaluates weaknesses in an authorized environment. A governance specialist assesses controls and risk. Each role requires a different combination of knowledge, judgment and practice.

The UK report's analysis of job advertisements offers another clue. Among core cybersecurity postings that specified minimum experience requirements, 34% asked for two to three years of experience, while 16% asked for zero to one year. These figures apply only to postings with a stated minimum requirement, but they illustrate why some newcomers may struggle to find their first role. GOV.UK

A certificate can show that someone has studied a subject. It cannot, by itself, demonstrate how that person investigates an alert, documents evidence or communicates a technical finding to a manager.

The answer isn't to abandon formal education. It's to connect education with practical work before a candidate's first full-time cybersecurity role.

Make the first step more structured

Organizations and training providers can help close the gap through three measures:

• Use realistic exercises. Let learners investigate simulated incidents, review logs, assess vulnerabilities and document their findings in controlled environments.
• Define role-specific expectations. An aspiring SOC analyst needs different practical evidence from someone preparing for penetration testing or security governance.
• Create supervised entry points. Internships, apprenticeships, junior analyst rotations and mentored projects give newcomers a way to demonstrate their skills while learning professional practices.

The US National Institute of Standards and Technology (NIST) provides a useful reference through its NICE Workforce Framework for Cybersecurity. Its framework describes cybersecurity work through tasks, knowledge and skills, helping organizations connect job responsibilities with the capabilities people need to perform them. NIST's guidance on proficiency also emphasizes demonstrated workplace capability rather than relying solely on academic knowledge or time spent in the field. NIST

This gives employers a more practical way to assess candidates. Instead of asking only which courses someone has completed, they can examine what the person can actually do and identify what still requires supervision.

Build the pathway before the vacancy

For Indonesia's cybersecurity workforce, the opportunity is to make the transition from education to employment more deliberate. Training providers can align learning with recognizable job functions. Employers can identify suitable supervised assignments and define what entry-level competence looks like. Learners can build portfolios that demonstrate their work, reasoning and documentation.

ITSEC Cyber & AI Academy can contribute to this process through structured cybersecurity and AI learning connected to professional capability development. The objective is to help learners build relevant knowledge and practical skills that can support their next career step.

A healthy talent pipeline needs experienced professionals, but it also needs a reliable way to develop the people who will become experienced tomorrow.

Looking to build your cybersecurity or AI skills? Explore learning opportunities at ITSEC Cyber & AI Academy.

References

1. UK Department for Science, Innovation and Technology. Cyber security skills in the UK labour market 2026. Published 29 September 2026. Read the official report
2. National Institute of Standards and Technology (NIST). Identifying Proficiency: NICE Framework Work Roles & Levels of Responsibility. Created 23 January 2026; updated 13 March 2026. Read the NIST guidance
3. National Institute of Standards and Technology (NIST). Workforce Framework for Cybersecurity (NICE Framework). Published 16 November 2020. Read the framework publication