If we’re being completely candid about the current state of cybersecurity education, we’re educating future professionals for an industry that no longer exists in the same form.

The way we teach cybersecurity, and most business disciplines, still follows a model that has remained largely unchanged since the Roman Empire. A professor has an idea of what's happening in the real world. The curriculum is developed. The professor stands in front of a classroom. Books are read, exams taken and the hope is that the results will be applicable in the real world after graduation.

That’s no longer how cybersecurity, or business, works.

Today, learners control where, what and when they learn, switching platforms and approaches in real time. Instructors must adapt. Add AI, and learners can refine questions and reach better answers within minutes.

Now consider the current cybersecurity workforce development model. It is outdated even with accelerated courses and certifications, even before the curriculum is approved and printed. And with the rapid pace of chan​ge in cybersecurity, the current approach is inadequate and, I would argue, obsolete.

The gap between supply and demand is growing, with an estimated 500,000 job openings nationally in 2025.

The Curriculum Gap Is Now a Capability Gap

By the time a cybersecurity curriculum is approved, printed and taught, parts of it are already obsolete. AI is accelerating that gap.

Historically, students graduated into entry-level roles (security operations center (SOC) analysts, junior consultants), where they learned by doing under the guidance of more experienced practitioners. Today, most of those roles are disappearing. Triaging alerts, writing basic code and performing repetitive analysis are increasingly handled by AI-enabled systems or more senior analysts using AI tools to complete in minutes what would take a junior resource hours to complete.

Companies like ours already use AI to handle routine security tasks that were once used to train entry-level analysts, fundamentally reshaping how teams are built and promotions are given.

Yet we’re still teaching students how to do the very tasks technology is replacing. That is a waste of time, talent and sadly, students’ money.

At the same time, many institutions treat AI as a separate discipline with its own major or concentration rather than embedding it across cybersecurity, finance, operations and all other classes. That approach misses the point. AI isn’t a specialty; it’s a foundational capability. It must be applied across all disciplines. The business world already has.

Students who want to compete with job seekers who hold a year or two more experience need to master AI mechanics. But they must know how to apply it responsibly, effectively and in context.

From Entry-Level Tasks to Day-One Judgment

What the workforce needs now is fundamentally different.

We don’t need more people who can execute tasks. We need people who can make decisions.

In a modern security operations environment, AI handles the noise. What remains are the moments that require judgment, such as what an alert means, what action to take and whether to escalate an issue to a more experienced practitioner.

These are Level 2 and Level 3 analyst decisions, skills that traditionally took years to develop, but now we need them on day one. It’s like taking a student out of electrician school and saying, “Go be a master electrician.” The apprenticeship layer is disappearing, and we haven’t redesigned education to account for it.

This shift is also reshaping the workforce itself. What used to be a pyramid with many entry-level roles feeding into fewer experienced ones is becoming a diamond. There are fewer entry-level opportunities and greater demand in the middle for high-judgment talent.

Over 70% of cybersecurity professionals say AI is increasing the need for specialized and strategic skills, not decreasing it. A new type of training is needed, based on discernment rather than rote learning.

What’s Being Taught and What Isn’t

For too long, education has emphasized memorization and static knowledge. In an AI-enabled world, that’s no longer the differentiator. What matters now is the ability to interpret, question and act, especially when working alongside AI systems.

Demand for AI-related skills is growing rapidly, with job postings requiring AI expertise increasing more than 70% year over year. Within the next year, I would predict that all job postings will include AI elements.

In cybersecurity, we no longer write code line by line. We understand what needs to be built, why it matters and how to use the output effectively.

Cybersecurity, by its nature, confronts adversaries, and yet many programs still underinvest in teaching how bad actors think, adapt, pivot and exploit systems. Without that perspective, you’re always reacting instead of anticipating.

At the same time, we are exposing students to increasingly powerful tools, including how systems are exploited and what exists on the dark web, without always grounding that knowledge in a strong ethical framework.

That’s a growing risk.

AI is not only transforming defense but also making attacks faster, more scalable and accessible to a broader range of actors.

Knowledge without a moral compass doesn’t just create skilled professionals; it can create more capable and incentivized adversaries.

Why Real-World Learning Can’t Be Simulated

A common assumption is that better simulations will solve this problem. However, the truth is that cybersecurity evolves at such a high speed that even simulations quickly lose their relevance.

Instead of simulating reality, we need to bring students into it by shifting from theoretical learning to applied experience, especially for students who can’t afford to wait to apply what they’ve learned.

In addition to traditional students, many learners today work full-time, supporting families or navigating complex life circumstances. They don’t have the luxury of a “learn now, apply later” model. They need learning that is immediate, relevant and connected to real work.

Rethinking the Roles of Universities and Industry

To meet today's learning needs, the model itself has to change. Learning environments should look more like real operating environments, with businesses embedded into classrooms, practitioners contributing directly to instruction and students working on real or recently resolved problems.

In cybersecurity, that could mean analyzing real alert scenarios, participating in guided investigations and seeing how decisions are made in the context of an actual cybersecurity event. The curriculum should be continuously shaped by real business needs not theoretical assignments. And the role of the professor should evolve from lecturer to guide.

But none of this will matter if the faculty are unprepared. The preparedness of instructors acts as a multiplier. Faculty must first understand how their role is changing, then comprehend how AI is evolving their disciplines and how to teach students to use it effectively. Then they need to come alongside students and teach them to use AI effectively for solving real-world problems.

That also requires a cultural shift. Using AI should be legitimized, not penalized. In the real world, it has become foundational.

A Shared Urgent Responsibility

This is an issue for the ecosystem as a whole, which includes universities, corporations, students and parents. Should any of these players choose not to participate in the process, then the entire system is doomed.

In particular, corporations need to assume the mantle of being a co-creator for new talent. Otherwise, the corporations will assume the lion’s share of onboarding costs, which is exactly what is happening.

At its core, cybersecurity isn’t just a technology problem. It’s a people problem. And right now, we are collectively ill-prepared for that reality because, as we continue to debate curriculum and majors, the world changes.

If we do not reconsider the approach to education of cybersecurity experts by introducing AI, focusing on judgment, ethics and linking learning to practical experience, we’ll continue losing a fight we can’t afford to lose.​

This article was originally published by the Forbes Business Council.