Cybersecurity Careers Should Start Before University

INTRODUCTION How much of what a vulnerability scanner flags every week actually turns out to be real? Research from OWASP puts the false positive rate for common vulnerability types somewhere between 15% and 30%, and separate research from Snyk found that security teams now spend roughly 70% of their time chasing alerts that end up being nothing at all. That gap between what a tool reports and what is actually exploitable is not a minor inconvenience. It is the reason a third of companies surveyed admitted they responded late to a genuine attack because their team was buried in phantom threats instead. ITSEC Asia, Indonesia's leading cybersecurity company, works with organizations across the region that have learned this the hard way, and the question that keeps coming up is simple. If a scanner already checks the boxes, why does AI-powered penetration testing exist at all, and what does it actually do differently? Source: OWASP false positive research via DEV Community [https://dev.to/kuboidsecurelayer/why-automated-vulnerability-scanners-miss-most-real-security-vulnerabilities-2p96] · Snyk: Minimizing False Positives [https://snyk.io/blog/minimizing-false-positives-enhancing-security-efficiency/] THE FUNDAMENTAL DIFFERENCE: FOLLOWING RULES

A security alert arrives. An analyst opens it, checks the surrounding activity and begins reconstructing what happened. That sounds like the beginning of detection work. In reality, a considerable amount of work happened earlier. Someone decided which events should be logged, configured the systems to produce them, collected those records centrally and made sure the data contained enough detail to support an investigation. If that work is poor, even an excellent analyst is starting with missing pages. An upcoming ITU cybersecurity exercise in Dushanbe makes this dependency unusually explicit. During the three day program from 21 to 23 September 2026, teams will configure centralized monitoring and telemetry collection before responding to simulated ransomware, data exfiltration, server compromise and command and control traffic. The methodology has a catch: performance against attacks on Day 3 depends on the monitoring participants configured on Day 2. That’s a useful model for SOC training. VISIBILITY IS A SKILL SOC development often concentrates on the visible part of the job: analysing alerts, threat hunting and incident response. Those capabilities

There used to be a fairly predictable starting point for a cybersecurity career. Learn networking. Understand access control. Get comfortable with security operations. Then, after some experience, start tackling the newer and more complicated stuff. AI is messing with that sequence. On 1 September 2026, ISC2 introduced its updated Certified in Cybersecurity exam outline, the first major content revision since the entry-level certification launched in 2022. Foundational AI concepts are now integrated into the material, including identifying AI assets, recognizing automated threats and supporting secure governance of emerging technologies. Its updated AI guidance goes further. Cybersecurity professionals increasingly need competence in AI governance, model security, data integrity, prompt engineering, AI risk management and the security of AI-enabled systems. That’s quite a list for something that was recently considered a specialist topic. AI SECURITY IS MOVING DOWN THE CAREER LADDER There’s a practical reason for this. AI-enabled systems are entering everyday business operations. At the same time, AI can be used for phishing, social engineering and increasingly automated attacks. Indonesia is already preparing for that reality.