Limor Kessem, CISM, C|ISO

Historically, cybersecurity has never been a true entry-level field. Most people start in IT to learn how networks and systems work, then transition into security roles over time once they have a certain amount of foundational knowledge and experience. That said, many companies, colleges, and training institutions have a strong monetary incentive to present cybersecurity as entry-level. They make significant amounts of money selling bootcamps and certifications to people eager to break into the field. After completing these programs and earning a few credentials, many newcomers discover that employers are looking for things they still do not have, most commonly hands-on experience in IT or adjacent roles. This disconnect often leads to frustration and backlash toward employers, who are accused of setting unrealistic expectations for entry-level security jobs. In reality, though, the expectations themselves are not new. What _is_ new is the narrative that cybersecurity is supposed to be an easy or direct entry point into tech. True entry-level cybersecurity roles do exist, but they are not the norm for most roles. To me, being upfront and honest about that reality would save a lot of newcomers time, money, and frustration.