“The child who is not embraced by the village will seek warmth elsewhere” – African proverb
Every week, organizations warn of a global cybersecurity skills shortage. In fact, for some countries like the UK, it has been repeated so many times that it has lost a lot of meaning, with some analyses saying it takes as long as six months to find qualified candidates.
Yet, every week, aspiring analysts with certifications and degrees and extensive Udemy training from being told to upskill, who have home labs and GitHub portfolios so they can “build in public”, as well as Capture the Flag experience, receive rejection emails because they lack “commercial experience” or are not a culture fit.
If the industry is facing such an acute talent shortage, why are so many capable candidates unable to secure their first opportunity? Perhaps the challenge is not a shortage of cybersecurity talent, but a shortage of accessible pathways into the profession. In our pursuit of experienced practitioners, we have built hiring processes filled with filters, gatekeepers, and unrealistic expectations that often exclude the very people we claim to need.
If the cybersecurity industry is serious about closing the workforce gap, it must confront an uncomfortable truth: our hiring practices may be strengthening the very threat ecosystem we are trying to defeat.
When Hiring Becomes a Barrier
In trying to reduce hiring risk, many organizations have unintentionally built one of the most restrictive entry points in the technology sector. The irony is difficult to ignore. At the very moment the industry is calling for more defenders, it is making it increasingly difficult for new ones to enter.
Job descriptions routinely ask for multiple years of experience for entry level positions. AI powered applicant tracking systems reject candidates before recruiters assess their technical ability. Certifications like CCSP and CISSP, which require at least five years’ experience, have become prerequisites rather than differentiators, while practical skills are often overlooked in favor of conventional career paths. The result is a hiring process that constantly filters out not only unqualified applicants, but also future cybersecurity professionals.
Cybercrime Has Fewer Gatekeepers
Unfortunately, legitimate employers are not the only communities competing for technical talent. While legitimate organizations continue searching for the “perfect candidate,” one who can corporate-speak and recite answers to “tell us about a time” questions with STAR answers, cybercriminal communities often provide something many newcomers struggle to find; accessible entry points, practical learning opportunities, mentorship, the allure of quick money and a clear path to developing technical skills.
Cybercriminal ecosystems operate very differently. They do not require university degrees, commercial experience, or industry certifications before someone can participate. They reward curiosity, technical ability and contribution. Newcomers can learn from peers, collaborate within communities, gain practical experience, and build reputations based on what they can do rather than what appears on their CV.
This is not an endorsement of cybercrime, nor is it a suggestion that becoming a successful cybercriminal is easy. Developing advanced offensive skills takes years of dedication and technical expertise. However, the barriers to entering those communities are often significantly lower than those facing someone seeking their first legitimate cybersecurity role.
Studies have also shown that most people do not begin their journey intending to become cybercriminals. They begin because they are fascinated by technology, are curious, enjoy solving complex problems or want to understand how computers work. The environment that welcomes and develops that curiosity often shapes where it ultimately leads.
Why This is a Security Problem
When aspiring professionals spend months or even years facing rejection despite demonstrating initiative and practical skills, frustration inevitably grows. Some leave cybersecurity altogether for software engineering or IT, others may abandon the profession before it has even begun. A small subsection may be drawn towards communities that offer immediate opportunities to learn, contribute, and gain recognition, even if those communities operate outside the law.
This should concern every security leader because it transforms what appears to be a hiring issue into a broader cybersecurity challenge.
Every capable candidate who walks away from the profession represents lost defensive capacity and every unnecessary hiring barrier slows workforce development at a time when organizations repeatedly acknowledge they cannot recruit enough skilled professionals. Meanwhile, cybercriminal groups face no comparable shortage of applicants willing to learn, collaborate and refine their capabilities.
Little wonder why we have seen over 5000 claimed ransomware attacks and counting in 2026 alone from ransomware-as-a-service (RaaS) operators.
Raising Standards Without Raising Barriers
Some will argue that cybersecurity is simply too important to lower hiring standards, and there are elements of truth to that. Organizations responsible for protecting sensitive government data and critical infrastructure cannot afford to compromise on competence as it can have dire consequences.
Lowering unnecessary barriers is however, not the same as lowering standards. Hiring for demonstrated capability rather than narrowly defined experience can strengthen security rather than weaken it. Practical assessments and presentations, apprenticeships, internships, mentoring programs and portfolio-based evaluations provide far more meaningful indicators of future performance than arbitrary experience requirements.
A candidate who has built a home Security Operations Center (SOC), contributed to open-source security projects, published research or consistently performs well in Capture the Flag competitions may possess greater potential than someone who simply satisfies years of experience or certification requirements.
The Door We Choose to Open
The cybersecurity community has always prided itself on innovation, adaptability and solving difficult, oft novel problems and it is time to apply that same mindset to how we develop talent.
If we genuinely believe the cybersecurity workforce shortage is one of the defining challenges facing our industry, then we must also recognize that recruitment is part of the solution.
Organizations should invest in structured entry level pathways, expand apprenticeship programs, strengthen partnerships with universities and community organizations, and embrace skills-based hiring that recognizes potential alongside experience.
Every experienced cybersecurity professional was once a beginner who needed someone’s “embrace.”
Click Here For The Original Source.
