Of course you don&#x27;t need to know how to write shellcode, or have in-depth knowledge of anti-debugger reversing tricks, to write a very useful and robust security policy for an organisation, or manage a global incident response team. I wouldn&#x27;t be so quick to dismiss the degree just because it doesn&#x27;t teach &#x27;practical&#x27; security. It&#x27;s the same story with Computer Science degrees, which don&#x27;t teach about source control or agile software methodologies, since these &#x27;practical&#x27; subjects aren&#x27;t really anything to do with CS.