This is a big reason I stayed away from infosec, although it fascinates me in many aspects.<p>IMO, security orgs, especially within companies have this awful reputation because they borrowed the credentialing model of project managers and walk around like doctors with an alphabet soup of certifications. Talking to these folks is like crossing a circa-1998 MCSE with a lawyer.<p>The CPE requirements from CISSP and other certs encourage publishing and delivering talks, which is good -- if the authors&#x2F;talkers are competent. The side effect within enterprises and some vendors is you develop a cadre of bullshit artists who are great at throwing spears, not so great at doing anything of value.