Cybersecurity: university degree or certification—what do the published data say?

Interpret ISC2’s workforce gap with caution

According to ISC2’s 2024 study, published on September 11, 2024, the cybersecurity workforce gap increased by 19% year over year to reach 4.8 million positions. The organization defines this gap as the difference between the existing workforce and the workforce considered necessary.

ISC2 is a professional association that issues certifications. It therefore has an interest in documenting the shortage. This does not make the study false, but it does call for reading the figure as a survey-based estimate, not as a count of job openings. The method used to calculate the gap can be found in the full report.

The study also indicates that 90% of organizations report skills gaps within their security teams, and that 64% consider the lack of skills more serious than the lack of staff.

Identify what the study says about hiring

The 2024 study provides data on team composition. According to the study, 31% of respondents say their security team has no entry-level employees, and 15% have no junior-level employees (one to three years of experience). The study indicates that 62% of the managers surveyed had positions to fill. It emphasizes that recruitment favours intermediate and advanced candidates.

These figures matter for a new graduate. They suggest that the shortage is primarily a shortage of experienced people. The market for entry-level positions can remain difficult, even when the overall gap is large.

The study also reports that nearly a quarter of respondents in North America and Europe experienced cybersecurity layoffs in the last twelve months, as did 29% in the Middle East and Africa. It attributes these layoffs to economic constraints.

Read the U.S. projections

The BLS projects 21% growth in employment for information security analysts between 2025 and 2035, classified as much faster than the average for all occupations. Their median salary was US$129,180 in May 2025.

For entry into the occupation, the BLS typically indicates a bachelor’s degree in computer science or a related field, such as engineering or mathematics. It specifies that some workers enter with a high school diploma, training and certifications. It notes that many employers prefer candidates who hold an information security certification, without naming a specific certification.

These figures describe the U.S. market for a specific occupational category. They do not replace statistics for the country being considered.

Compare degrees and certifications in a table

The table below outlines the roles generally attributed to degrees and certifications. It is a framework for interpretation based on the cited sources, not a ranking.

This table simplifies matters. A computer science degree does not automatically provide security skills, and a certification does not provide the theoretical depth of a degree. The two complement rather than oppose each other. The BLS itself mentions both: a bachelor’s degree as the typical entry-level education, and certifications as a preference of many employers, including for entry-level positions.

Check certification requirements

Certifications are not equivalent. Some are aimed at beginners, while others require years of experience. ISC2 offers, for example, the Certified in Cybersecurity (CC) certification, described on its page as an entry-level certification requiring no work experience. At the other end of the spectrum, the CISSP certification page mentions a five-year experience requirement, with eligible domains and exceptions for internships; the details of these rules should be read directly on the organization’s website, as they change over time.

The important point is that an advanced certification does not replace experience. A beginner cannot obtain it in full and should first aim for entry-level certifications, then positions that allow them to accumulate the required experience.

The ISC2 study notes that managers often expect combinations of experience and certifications that are difficult to bring together. Candidates benefit from reading actual job postings to identify the certifications requested in their region.

Assess the impact of artificial intelligence

The 2024 study reports that more than a third of respondents identify artificial intelligence as their team’s largest skills gap. Another question concerns skills considered important: AI is cited by 12% of hiring managers, compared with 23% of professionals. These percentages therefore do not measure the same thing as the skills gap.

This difference suggests that teams and their managers do not perceive the need in the same way. It calls for caution: a fashionable skill is not necessarily requested in job postings.

For a student, the solid foundations remain networking, operating systems, programming, cryptography and risk management. This knowledge transfers from one technology to another.

Another signal to interpret with caution: the ISC2 study is a survey of professionals and managers, so it reflects perceptions rather than an objective measurement of needs. Perceptions reflect each respondent’s position within the organization, and they can change quickly when a new tool appears. When choosing courses, current job descriptions remain a better guide than any trend study.

Build practical experience

Since demand focuses on experience, internships, projects and competitions play an important role. Capture-the-flag competitions, home labs, contributions to open-source projects and internships on security teams provide work to show an employer.

University programs that incorporate internships or team projects with real organizations reduce the gap between a degree and a first job. It is useful to ask a program where its graduates have worked over the last two years.

For people changing careers, a short training program can complement an existing degree in computer science, networking or systems administration. It then serves as a specialization, not a starting point.

Here are practical ways to document a skill:

• a written description of a home lab, including the tools used and the results;
• participation in security competitions, including the ranking achieved;
• an internship or summer job on an IT team, even without a security title;
• a documented contribution to an open-source project.

What about Canada?

Cybersecurity occupations are not regulated in Canada in the way that engineering or health professions are. The title of engineer, however, is protected: a graduate who wishes to use it must go through the provincial regulatory body. Employers primarily ask for computer science degrees, certifications and experience. Employment statistics by occupation are published separately by federal agencies; they should not be confused with the U.S. figures in this article. ISC2 certifications are international: they can be taken in Canada as elsewhere, independently of the university system, allowing them to be combined with a Canadian degree.

StudyCanada features, among others, the computer science programs at the University of Waterloo and the University of Ottawa / Université d’Ottawa, as well as the cybersecurity programs at McGill University and Université de Montréal (information systems management and security). The University of Waterloo is listed for general computer science, not for a dedicated cybersecurity program.