Cyber Certifications Have Failed. How to Build and Prove Cyber Skills

Abstraction: Traditional cyber certifications fail; continuous exercising builds real resilience

Key points:

• Despite 96% of organizations encouraging certifications, only 32% agree they are effective; nearly half say employees would still fall for phishing emails after security training
• 86% of organizations are operationalizing a cyber resilience program, but 52% lack a comprehensive approach to assessing it
• Five-step framework: adopt a formal resilience strategy, CISOs lead board discussions, measure real capabilities (not just attack counts), invest in continuous exercises, recruit for potential not certifications
• Timeline between vulnerability disclosure and attack activation is measured in hours or days, making quarterly training obsolete
• Generative AI is accelerating threats (e.g., sophisticated phishing scripts), making the mismatch between certification-focused training and real skills more dangerous
• SEC may require board-level cyber expertise under new regulations

Connections: Cybersecurity · Cyber Resilience

Source: https://www.forbes.com/sites/jameshadley/2023/07/24/cyber-certifications-have-failed-there-is-a-better-way-to-build-and-prove-cyber-skills/