Thinking of a Cybersecurity Career?
I think the cybersecurity (I hate the term cyber btw as it&#x27;s usually used by people who don&#x27;t know what they&#x27;re talking about), is very focused on the &#x27;think like a hacker&#x27; skillset right now.<p>While I do agree this is important in various roles in the security realm, there are also many jobs where this doesn&#x27;t really add value. A lot of work is about implementing things like MFA, role-based-access etc where knowledge of the platform used (e.g. Microsoft) and internal processes are more important. After all, most companies already fail at the &#x27;fix the obvious&#x27; stage, it&#x27;s not necessary to go looking for clever ways in when there are many doors left open.<p>Just to elaborate: A lot of discussions go like this. A pentest or random scan finds obvious issue. Ticket is raised to the security team. They go like &quot;WTF why do we still have Windows 95?? Kill it.&quot;. Then their boss goes like &quot;Sorry, Bill the manufacturing VP lobbied with the CEO, we have to leave that one alone&quot;. Of course when it actually gets hacked, Bill is nowhere to be found. This is why internal influencing skills are so important in real everyday security jobs.<p>Of course in the pentesting role this kind of thinking is absolutely necessary. However even there the kind of training given right now is too much in the realm of &#x27;scriptkiddie&#x27;ism. Hacking is about inventing and true mastery of technology, not about using the tools everyone uses. Being able to run metasploit and wireshark does not make one a hacker. By doing this, pentesters test for yesterday&#x27;s hacks, not tomorrow&#x27;s.