The Most Dangerous Misconception of the AI Era: That Studying Cybersecurity Has Become Pointless

Exploring the Fundamental Reasons AI Still Struggles to Replace Human Security Work

Not long ago, at a Cyber Guardians security camp, a middle school student asked me a question that caught me off guard.

“I’ve been reading articles about systems like Mythos. If AI eventually does all the cybersecurity work for us, why would people still need to study security?”

It was one of the most surprising questions I had heard in years.

Until recently, I mostly heard concerns like this from junior practitioners, university students, and job seekers. Now even middle school students are asking the same question.

When you look at the world around us, perhaps that should not be surprising.

Almost every day, we see another headline about AI breaking through a boundary that used to belong exclusively to human experts. AI systems outperform humans in programming competitions, discover vulnerabilities that have survived for years, solve CTF challenges, and even produce real-world exploits.

We are watching AI dismantle, one by one, problems we once assumed required human expertise.

For people who have spent time in CTFs, the change feels even more immediate.

There was a time when we were amazed whenever a model solved a single difficult challenge. Now we increasingly find ourselves asking how far the latest model got—and occasionally seeing it propose approaches that appear genuinely viable.

That is why questions like these are everywhere:

“Are developers going to disappear?”

“Will accountants, lawyers, and doctors still be needed?”

“Are degrees and professional expertise becoming meaningless?”

For people studying cybersecurity, those anxieties eventually converge on a single question:

If AI can hack, why should I keep struggling to learn all of this?

I do not think we should dismiss that question.

Nor should we underestimate AI. Given the current pace of progress, AI will almost certainly automate far more cybersecurity work than many of us expect.

But there is one distinction we absolutely have to make:

An AI being good at a task and the human who used to perform that task becoming unnecessary are not the same proposition.

There are far more conditions between those two outcomes than most discussions acknowledge.

And once we examine those conditions carefully, I arrive at almost the opposite conclusion.

The value of the fundamentals we acquire by studying cybersecurity is not disappearing. What is changing is the layer of work at which those fundamentals will be required.

Cybersecurity education therefore remains highly relevant.

Let me explain why, slowly and as plainly as I can.

If you do not have time to read the entire article, I would at least recommend reading Section 7: “So Who Will Companies Actually Hire?”

1. The First Misconception We Need to Abandon: “AI Can Do It, Therefore Humans Are No Longer Needed”

There is a common logical shortcut in this debate:

AI can perform a particular task well. Therefore, humans are no longer needed.

A great deal is missing between those two sentences.

The technical capability to perform a task and substitution at a level that allows an organization to eliminate the human role altogether are fundamentally different concepts.

Consider the familiar example of ATMs.

ATMs automated one of the most visible functions traditionally performed by bank tellers: handling cash deposits and withdrawals.

Common sense might suggest that the number of bank tellers should therefore have collapsed.

But that is not quite what happened.

At the average urban bank branch in the United States, staffing fell from roughly 20 employees in 1988 to around 13 in 2004. Yet over the same period, the number of urban branches increased by 43 percent. Technological changes including ATMs lowered the cost of operating branches, while deregulation and market competition also contributed to branch expansion. At the same time, the teller's role shifted away from simple cash handling toward customer relationships and financial-product services (Bessen, “Toil and Technology”).

Of course, ATMs and AI are not equivalent technologies.

I am not using this example to argue that AI can never reduce employment.

The point is narrower, but much more important:

You cannot calculate the final number of jobs in an economy simply from the fact that one task has been automated.

Technology can simplify or eliminate tasks.

But it can also:

reduce the cost of a service and thereby increase demand,
increase the value of the work that remains,
or fundamentally change the role humans perform within an occupation.

Economic research likewise suggests that the employment impact of automation depends not only on productivity gains but also on the demand created by those gains (Bessen, “AI and Jobs”).

In cybersecurity, the relationship is even more complicated.

Security professionals do not simply “find vulnerabilities.”

They continuously make decisions about:

which systems should be tested,
which accounts may be used,
how far access should extend,
which actions are permitted and which are too dangerous,
and what should actually be done with a finding once it has been discovered.

A tool becoming more powerful does not make the organization's decision-making structure or accountability obligations less important.

If broadly deployed AGI eventually becomes a reality, this discussion may have to be revisited under an entirely different set of assumptions.

But if we are talking about the development trajectory of LLMs and AI agents that we can actually observe today, jumping directly from model performance to wholesale human replacement skips far too many intermediate steps.

Depending on how one defines AGI, I am personally skeptical that the kind of globally ubiquitous AGI sometimes associated with Elon Musk's vision—a world in which people no longer need to work and can obtain almost anything they want—is around the corner. Achieving something of that scale would require overcoming major constraints in energy, compute architecture, and our incomplete understanding of deep learning.

And even if such technology were invented, deploying it at global scale would introduce another layer of political, economic, and geopolitical challenges.

2. Why the Cybersecurity Industry Is Especially Prone to Overestimating AI

Cybersecurity has one unusual characteristic that can make us particularly vulnerable to extrapolating AI performance too far.

CTFs.

Watching an AI solve CTF challenges, crack pwnables, discover vulnerabilities, and produce exploits is extraordinarily striking.

We have all seen it happening.

And for a hacker, few demonstrations of AI feel more directly threatening.

But there is a distinction we have to make.

CTF security and enterprise security are both called “cybersecurity,” but the structure and complexity of the problems are fundamentally different.

A CTF is somewhat like an escape room.

You know that an answer exists somewhere inside the room.
The challenge designer intentionally planted a vulnerability.
The target is defined.
The scope is defined.
The problem has a beginning and an end.
And if you destroy the challenge server while solving it, no real customer or business suffers the consequences.

Enterprise security is not an escape room.

It is closer to inspecting an entire city in which millions of people are actually living.

You may not know where the problem is.
You may not even know whether a vulnerability exists.
You cannot shut down the power grid merely because you want to test it.
You cannot block an expressway during rush hour just to see how the traffic system behaves.
And most importantly, the city continues to change while you are inspecting it.
New buildings appear. Roads change. Residents move. Policies are rewritten.

The closer we get to real-world conditions, the more difficult the problem becomes for current AI systems as well.

The 2026 AgentCyberRange study constructed environments closer to real enterprise intrusion scenarios using 15 real-world web applications and 156 internal hosts. In the original evaluation, the best-performing system at the time solved 16.1 percent of the web exploitation tasks and 31.7 percent of the post-exploitation tasks without specific hints (F. Liu et al.).

But the important takeaway is not:

“AI can only solve 16 percent.”

That number will almost certainly rise.

The real lesson is this:

There is an enormous gap between solving a problem when you already know that an answer exists and operating in the real world where you must first determine what the problem actually is.

We should absolutely be impressed by what AI is accomplishing in CTFs and bug bounty environments.

But we should not project the shock we feel in CTFs onto every real-world cybersecurity role.

CTF work and enterprise security may occupy the same broad domain, but treating them as interchangeable is a dramatic oversimplification.

We are also living through a noisy transition period in which commercial incentives, aggressive product positioning, spectacular demos, and genuine technical breakthroughs often arrive at the same time. That makes it unusually difficult to separate actual operational capability from expectations about future capability.

Executives without deep technical expertise may reasonably experiment with the idea that AI can replace human labor, and those expectations may influence hiring behavior at the margin.

But employment in a complex economy behaves more like a network of interlocking gears than a single switch.

Interpreting every reduction in hiring through AI alone risks turning a complicated phenomenon into a confirmation bias.

3. Now Imagine a Future in Which AI Really Has Replaced Security Workers

Rather than debating this abstractly, let us construct a concrete scenario.

Suppose we really have reached a future in which AI has caused a major reduction in cybersecurity employment.

For that to happen, AI cannot merely be good at writing reports or answering security questions.

It would have to perform a substantial portion of the work humans currently perform, end to end, inside real enterprise environments.

Automation pressure usually reaches repetitive and structured work first.

That means junior-level work is likely to be among the first areas affected.

Depending on the role and organization, common early-career security tasks may include:

SIEM and EDR alert triage,

log analysis,

phishing-email and IOC investigation,

reviewing vulnerability scanner output,

eliminating false positives,

vulnerability prioritization,

endpoint and cloud configuration reviews,

access reviews,

SAST and DAST alert classification,

incident ticket management,

evidence collection,

and initial response under predefined playbooks.

ISC2's 2026 survey of 856 cybersecurity professionals actively using AI similarly identifies tasks such as alert triage, log analysis, report generation, vulnerability prioritization, and basic threat hunting as areas where AI is already performing or accelerating work that has traditionally formed part of entry-level and junior roles (ISC2, “Rethinking”).

I have little doubt that much of this work will be automated.

But now we need to go one step further.

Many problems that appear obvious at first become very different once you break them apart.

Suppose an AI analyzes an alert and concludes:

“This appears to be legitimate administrator activity. False positive.”

Can it close the alert on its own?

Now suppose it says:

“There is a high probability of attacker lateral movement.”

What happens next?

Do we immediately lock the user's account?

Do we isolate the endpoint from the network?

Do we revoke every active session token?

Do we rotate or revoke the AWS access key?

Do we change firewall policy?

Do we reboot the production server?

And then the more important questions begin:

On what basis?

Using what procedure?

For how long?

With whose authorization?

At this point, the nature of the problem has changed.

What began as a technical-analysis problem has become a problem of Context, Authority, Reliability, and Accountability.

If AI is going to replace the human worker rather than merely assist them, it must solve all four categories of problems that follow the initial analysis.

What we observe at the surface may be caused by something entirely different underneath.

That is why, consciously or unconsciously, humans move from an observed symptom toward the underlying reality whenever we investigate a problem.

Cybersecurity is a field in which the distance between the symptom and the underlying reality can be especially long and complicated.

Sometimes the answer can be found in structured, recorded data.

But sometimes the information required to solve the problem exists in intangible, undocumented form.

When humans work together inside an organization, not every potentially meaningful piece of information communicated through chat messages, conversations, gestures, tone of voice, or behavior is documented.

Suppose the engineer responsible for a system leaves their desk for ten minutes to take a phone call.

They return.

Then they receive another call from the external infrastructure vendor, appear visibly concerned, leave again, and start searching for someone from another team.

Do we continuously convert every one of those observations into machine-readable context for an AI?

We could try.

But doing so would itself become expensive and operationally inefficient.

Understanding an observed phenomenon leads to another question that takes us closer to its cause.

The answer to that question can lead to another.

And another.

Some answers may depend on information that was never written down and was never inserted into a prompt or dataset.

Each answer can also create new responsibilities and new decisions.

We do not know how many derivative questions will appear.

We may not even know whether we have reached the real root of the problem.

And this state of not knowing what we do not know is precisely what organizations dislike most—particularly in a domain as sensitive as cybersecurity, where the people making the decision may ultimately have to absorb the consequences.

So perhaps we need to change the question.

Instead of asking:

“Can AI solve this security task?”

we should ask:

How much of the underlying reality required to solve the problem can the AI actually understand?

Will there be a future in which the answer is confidently 100 percent?

What would have to change for that future to exist?

And what would the scale of those changes actually look like?

Does that future really look as close as the current debate sometimes assumes?

Until we can answer those questions with much greater confidence, giving an AI unrestricted authority remains difficult.

And that is one reason humans remain necessary—not merely to observe the symptom, but to keep searching for the reality underneath it.

4. The Context Constraint: A Company Does Not Fit Inside a Prompt

When discussing the practical limitations of AI, people often point to the size of the context window.

A real company may have millions of lines of code, hundreds of servers, and interconnected systems spanning cloud infrastructure, VPNs, SaaS applications, Kubernetes, IAM, databases, endpoints, and CI/CD pipelines.

The obvious argument is that all of this cannot simply be placed inside a single context window.

That concern is valid.

But I think the deeper problem lies elsewhere.

The real question is not “How much information can we put into the prompt?” but “How do we know which information matters right now?”

Context windows will continue to grow.

RAG, external memory, code indexes, knowledge graphs, multi-agent architectures, and technologies that have yet to be invented will help us work around many present limitations.

A 2026 ACL paper on long-horizon software engineering agents, for example, notes that existing agents can suffer from context explosion, semantic drift, and degraded reasoning during extended interactions. Instead of simply preserving every previous interaction, the proposed approach selectively compresses and retains information judged to be relevant (S. Liu et al.).

Put more simply:

Making the desk bigger does not make the person sitting at it better at their job.

You can spread 100,000 company documents across an enormous desk.

If you cannot identify which three matter to the decision in front of you, the larger desk has not solved the problem.

And real organizations contain an even harder problem:

Not everything the company knows exists in a document.

Much of organizational knowledge exists as tacit knowledge—knowledge that may reside in people's experience, intuition, memory, or informal interactions rather than in formal documentation.

Some of that knowledge may be difficult to formalize at all.

A few examples:

“That server looks unstable, but for reasons the executive team has not broadly disclosed, it absolutely cannot be rebooted until the end of this week.”
“That account should normally have been deleted, but we agreed to keep it active until the migration is complete.”
“That traffic looks malicious, but I heard that an unannounced red-team exercise is scheduled for today.”
“The documentation says we use architecture A, but after last week's outage production is temporarily running through architecture B.”
“That customer has a different contractual arrangement, so their data-retention policy is not the same as everyone else's.”

Some of this information may be buried in a Slack message from a month or a year ago.

Some may exist in an email.

Some may be mentioned in meeting minutes.

Some may exist only in someone's memory.

Humans do not possess all of this perfectly either.

That is not my argument.

The point is that for AI to act with enough autonomy to replace humans, someone has to continuously curate, connect, update, and validate the context on which that AI depends.

Determining which information is relevant, which information is stale, and which exception is still valid becomes work in its own right.

Increasing a context window from one million tokens to ten million does not make the tacit-knowledge problem disappear.

Reading every manual does not turn you into the employee who has spent ten years inside the company.

Memorizing the entire driver's-license exam does not give you the same ability to navigate Seoul as a taxi driver who has spent twenty years on its roads.

Now imagine that responding to a single security alert requires a coordinated decision across six teams:

security,

engineering,

legal,

business,

customer support,

and executive management.

Can an AI meaningfully incorporate all of the undocumented histories, assumptions, exceptions, and tacit knowledge distributed across those teams?

Perhaps increasingly so.

But doing so is far harder than increasing token count.

The Harder Problem: Organizational Context Never Stops Changing

A company's context is not a static body of information that can be ingested once.

It keeps changing.

A decision that was correct at 10:00 a.m. may be wrong at 10:10.
Access that was prohibited yesterday may be authorized today.
A previously unimportant system may become critical after the company lands a major customer.
A single executive instruction can instantly change priorities.
One customer phone call can create an exception.
An outage can invalidate the existing runbook.
Departures and new hires can change the entire permission structure.

Laws change.

Contracts change.

Products change.

Organizational culture changes.

People change.

AI therefore does not merely need to “learn the company's documents.”

It needs a sufficiently accurate and current representation of the organization at the precise moment a decision is made.

Can an AI that exists within computational systems always possess enough information to make the optimal decision?

What if the critical information was never digitized?

What if it exists somewhere in an old meeting transcript, a Slack thread, a private DM, or an email but was never labeled as important?

What if the information exists digitally but is fragmented in ways that make its significance impossible to recognize without additional context?

No matter how large the context window becomes, this remains a different category of problem.

5. The Authority Constraint: Being Able to Do Something Is Not the Same as Being Trusted to Do It

Now suppose the AI does have enough context.

Have we solved the problem?

No.

If AI is going to replace the human rather than simply provide analysis, it needs sufficient execution authority to complete the work end to end.

This is where one of cybersecurity's defining characteristics appears.

The scope and autonomy of security work are ultimately constrained by how much authority the actor performing that work is allowed to exercise.

Consider a simple example.

An AI discovers malicious activity on a critical server.
From a pure security perspective, the safest option may be immediate isolation or shutdown.
But what if that server is currently processing hundreds of thousands of payments?
For the security team, immediate isolation may be the correct answer.
For the business team, estimating the potential loss and avoiding immediate shutdown may be the better answer.
The legal team may first worry about breach-notification obligations, evidence preservation, and potential liability.
Executives must weigh the intrusion risk against business interruption and reputational consequences.

Every one of them may be correct from their own perspective.

Now consider a suspicious login.

The AI recommends locking the account.

But perhaps:

it belongs to an executive traveling overseas,
it was temporarily elevated for incident response,
it belongs to a partner and is covered by a migration exception valid through this week,
an engineering manager briefly granted the access for testing,
or the anomaly was caused by a communication failure between departments.

What is the “correct” AI decision?

I suspect an AI assigned the role of “security operator” would often not be given unilateral authority over cases like these.

Cybersecurity does not exist only to preserve confidentiality and integrity.

It must also preserve availability, business continuity, and the ability of the organization to operate.

And ultimately, someone has to bear responsibility for those tradeoffs.

That means someone still needs to be capable of validating the AI's judgment.

The importance of that validation will become clearer in the next section.

The NIST Cybersecurity Framework 2.0 reflects a similar structure. It treats cybersecurity not merely as an IT problem but as part of enterprise risk management and introduced the GOVERN function to emphasize organizational context, risk tolerance, roles, responsibilities, and authority (Pascoe et al.).

The authority granted to AI agents has itself become a security concern.

In 2026, NIST published a separate concept paper examining identity and authorization controls for AI and software agents accessing multiple datasets, tools, and applications (Booth et al.).

Greater intelligence does not make this issue disappear.

On the contrary:

The more useful AI becomes, the more authority we are tempted to give it.

And the more authority we give it, the larger the potential damage from a single wrong decision.

A real enterprise is not a static CTF challenge.

It is a living system that keeps moving.

Which is why the critical question for a company is not:

“Can the AI do it well?”

but:

“Can we actually entrust it with this?”

Those are very different questions.

6. The Reliability and Accountability Constraints: Responsibility Is Not About Finding Someone to Blame After an Accident

There is a familiar argument in discussions about AI:

“Humans will still be needed because AI cannot be held responsible.”

I think the word responsibility has been used so casually that we sometimes forget how much weight it actually carries.

Responsibility does not simply mean that we need someone to punish if an AI makes a mistake.

It is a much more serious concept.

Accountability is one of the conditions that legitimizes the authority to make consequential decisions.

The relationship between authority and accountability is so fundamental that much of modern organizational life operates on top of it.

In general, the more consequential the decision a person is permitted to make, the greater the accountability attached to that authority.

Someone authorized to allocate billions in corporate funds must be able to explain why those funds were allocated that way.
Someone authorized to shut down a critical system must be able to explain why that decision was made.
Someone granted access to customer information assumes an obligation to handle that information appropriately.

Now imagine that we grant an AI enough execution authority to replace the human.

The AI's decision takes down a critical server.
The company loses tens of millions of dollars.
Or the AI incorrectly classifies attacker behavior as legitimate and millions of customer records are exposed.

Can management stand in front of customers or shareholders and say:

“The AI decided that.”

Does the matter end there?

Of course not.

The questions return to the organization.

Why did you select this AI?
Why was it given that level of authority?
Who assessed the risk?
Why was the human approval step removed?
Who ultimately decided that this was an acceptable risk?

The NIST AI Risk Management Framework similarly emphasizes explicit accountability structures for AI risk and assigns responsibility for major risk decisions surrounding AI development and deployment to organizational leadership (Tabassi).

Current practitioners appear to think about the problem in similar terms.

In ISC2's 2026 survey, 50 percent of respondents said that when an AI-recommended action produces the wrong outcome, a human decision-maker ultimately bears responsibility in their organization. At the same time, 47 percent were concerned about ambiguity over accountability when autonomous AI is used (ISC2, “Rethinking”).

Responsibility is not merely a mechanism for punishing someone after an incident.

We need to know who made the decision so that we can examine the context and reasoning behind it.
We need to know who approved it so that the decision-making structure can be corrected.
We need to know who held the obligation so that harm can be connected to remediation and redress.
We need to know where and why a control failed so that the same incident does not happen again.

In that sense, accountability is both a control mechanism that protects an organization from individual failures and a mechanism that gives us visibility into actions, decisions, and their consequences.

This is why replacing humans with AI cannot be reduced to a comparison of model accuracy.

As AI becomes more reliable, the frequency with which humans need to intervene may decline dramatically.

But the accountability structure that determines how much authority the AI receives and who ultimately absorbs the consequences does not automatically disappear.

7. So Who Will Companies Actually Hire?

Now we arrive at what I consider the most important question.

Unless we plan to live alone in the mountains and become entirely self-sufficient, most of us eventually participate in economic life.

And so the practical question is:

Who will employers actually choose in the market?

Let me reframe it.

Imagine that you are the CEO of a company. Which candidate would you hire?

Two people apply.

Candidate One has very little cybersecurity knowledge. They do not understand networking very well. They lack deep operating-system knowledge. They have not seriously studied web security.

But they are extremely proficient with AI.

Candidate Two understands networking, operating systems, programming, web security, vulnerability mechanics, and attack techniques. They can solve security problems independently.

And they are just as proficient with AI as Candidate One.

Your company has:

customer data,
trade secrets,
employee personal information,
software developed over many years,
and the possibility that a single security incident could cost tens of millions while forcing you personally to answer to customers, the media, regulators, and the board.

Who do you hire?

For most organizations, the answer is not difficult.

Candidate Two.

Candidate One has a fundamental weakness:

When the AI is wrong, they have no reliable way to know that it is wrong.

That is one of the deepest reasons security fundamentals still matter.

Suppose the AI says:

“An account takeover is possible through the OAuth Authorization Code Flow.”

The AI can report that result.

A nonexpert can forward the sentence to someone else.

But deciding whether it is genuinely a vulnerability,

whether it is simply expected protocol behavior,

what prerequisites the attack requires,

and what the actual impact is

requires expertise.

In other words, someone must determine what underlying reality produced the observed result.

And some of the information required to reach that underlying reality may exist outside the computer altogether.

Someone therefore has to understand:

what the AI investigated,

what it did not investigate,

what assumptions it made,

and why it reached the conclusion it did.

This is not purely theoretical.

In ISC2's survey, 65 percent of cybersecurity professionals using AI said they were spending more time determining when to trust and act on AI recommendations, while 63 percent said they were spending more time reviewing and validating AI-generated output.

And 62 percent did not believe that the need for foundational cybersecurity skills had declined despite advances in AI (ISC2, “Rethinking”).

That is an important signal.

AI is not eliminating cybersecurity knowledge. It is changing where that knowledge is applied.

In the past, you needed fundamentals because you personally had to read and analyze 10,000 lines of logs and code.

Now, you increasingly need those fundamentals to determine whether the conclusion AI drew from those 10,000 lines is correct.

In the past, you learned vulnerability mechanics because you needed to build the payload yourself.

Now, you increasingly need to understand those mechanics so you can distinguish a genuine attack from nonsense among hundreds of AI-generated payloads.

The application of the fundamentals is changing. The need for the fundamentals is not.

8. So What Will Actually Happen to Cybersecurity Employment?

Let us return to the hiring question.

I also want to avoid excessive optimism here.

AI is likely to reduce hiring in some areas.

We are already seeing signs of that.

In ISC2's 2026 survey, 56 percent of cybersecurity professionals using AI said that AI had reduced the need for entry-level positions to some or a significant degree over the previous year.

At the same time, 12 percent said the need had increased, while 53 percent believed AI was creating new types of entry-level roles (ISC2, “Rethinking”).

This will not be a comfortable era for someone whose entire professional value consists of basic alert review, simple vulnerability classification, report writing, or repeatedly operating scanners.

So I am not going to tell people:

“Nothing will change. AI is irrelevant. Do not worry.”

That would be detached from reality.

But the opposite calculation is also far too simplistic:

“If one person with AI can do the work of five people, cybersecurity employment will fall to one-fifth of its current level.”

That does not follow automatically.

If productivity increases fivefold, there is no economic law requiring output to remain constant.

Companies do not necessarily put every dollar they save into a drawer.

They can create more products.

Enter more markets.

Provide more services.

And cybersecurity may be an area where this effect becomes particularly significant.

Many organizations today are not buying or performing as much security as they would ideally like.

Budget constraints matter.

Security is also frequently perceived as a cost center rather than a direct revenue-generating investment.

Consider penetration testing.

Suppose a company currently pays for one pentest per year because that is what its budget allows.

Now imagine AI reduces the cost of the same class of assessment by 90 percent.

The company could simply continue testing once a year and keep the savings.

But it might instead test quarterly.

Or monthly.

Or every time it releases a major feature.

In other words:

The amount of labor required for a single security assessment may fall while the total volume of security assessment demanded by society increases dramatically.

That is one reason the employment impact of AI automation cannot be derived from AI capability alone.

The empirical evidence we have so far also suggests that productivity gains and job reductions do not necessarily move in lockstep.

A 2026 BIS Working Paper analyzed more than 12,000 nonfinancial firms in the European Union and the United States. AI-adopting firms experienced, on average, approximately 4 percent higher labor productivity in the short term, but the researchers did not identify a statistically significant negative effect on firm-level employment. They explicitly caution that the long-term effects remain uncertain (Aldasoro et al.).

And this leads to the question companies actually care about:

“Is using AI genuinely better for us than employing a person?”

The potential cost of AI failure remains difficult to estimate.

A 2026 study by the Korea Development Institute provides an especially useful illustration.

When KDI analyzed tasks across the Korean labor market, occupations in which at least some tasks could technically be automated using current AI capabilities accounted for roughly 72 percent of employment.

That sounds alarming.

But KDI then asked another question:

“Does replacing human labor with AI actually make economic sense?”

Once the cost of adopting and operating AI was compared with the labor cost that could realistically be saved, the result changed dramatically.

The share of jobs for which AI automation was estimated to be economically viable under current conditions fell to approximately 1.4 percent.

The study also suggested that high-skill, high-wage technical occupations may often exhibit stronger complementarity between humans and AI than full substitution because of contextual dependence and the continued importance of human judgment (남창우).

72 percent versus 1.4 percent.

That enormous gap captures something we should never forget when discussing AI replacement.

Technical automability and economically rational human replacement are completely different propositions.

Ultimately, companies will weigh the risks, the cost of adopting and operating AI solutions, and the cost and benefit of continuing to employ human professionals.

Their decisions will follow the result of that comparison.

Which means the real corporate question becomes:

Do the cost savings and productivity gains from replacing this person with AI sufficiently exceed the new costs and risks created by deploying, controlling, and supervising that AI?

And more precisely:

Which operating model gives the company the greatest benefit: humans alone, AI alone, or highly capable humans augmented by AI?

That third option matters enormously.

Suppose two AI-augmented security professionals can perform work that once required five people.

In the short term, demand for workers may decline.

We should not deny that possibility.

But suppose the productivity of those two people also enables the company to perform security work that was previously unaffordable.

The calculation changes again.

Companies do not replace workers because they are impressed by technology.

They replace workers after calculating gains, losses, and risk.

So the real question is:

After accounting for every new cost and risk created by removing this employee and handing the work to AI, is that actually more economical than giving a capable cybersecurity professional the same AI and letting them use it?

Only when the answer is convincingly yes does genuine labor substitution begin.

The fact that AI can perform the task as well as a human satisfies one variable in that equation.

Nothing more.

Replacing human labor inside a company is not a benchmark result. It is an economic decision.

9. Cybersecurity Will Also Have Far More Work to Do

There is another variable that makes cybersecurity somewhat unusual.

As the world becomes increasingly digital, the attack surface we need to defend continues to expand.

Cloud.

SaaS.

APIs.

IoT.

AI-generated code.

Autonomous agents.

Eventually, physical AI systems connected to networks.

Attackers are adopting AI too.

If AI dramatically increases the productivity of vulnerability discovery, then the total number of vulnerabilities that attackers can identify may increase as well.

That may mean defenders do not simply need stronger security.

They may need faster security.

ISC2's 2026 research similarly reports increased pressure for continuous remediation, patch management, and vulnerability management in response to larger volumes of AI-discovered vulnerabilities (ISC2, “Rethinking”).

So any serious long-term employment forecast needs to ask two questions simultaneously:

How much will AI increase the productivity of a single security professional—and how much new attack surface will emerge at the same time?

And:

As a result, how much more cybersecurity will society demand?

Looking only at the first question can produce a very distorted picture of the future.

10. What About the Claim That “LLMs Have Kicked Away the Ladder From Junior to Senior”?

There is another concern I hear frequently.

“If AI takes all the work juniors used to do, where are juniors supposed to gain experience?”

“Doesn't that destroy the ladder that leads to becoming a senior engineer?”

It is a legitimate concern.

If AI takes over much of the repetitive work through which junior practitioners traditionally accumulated experience, existing training pathways may indeed be disrupted.

But I see another possibility as well.

In the past, a junior analyst might have learned by manually classifying 100 vulnerabilities one at a time.

A future junior may learn by reviewing 1,000 AI-classified vulnerabilities, spotting the cases where the AI's judgment looks suspicious, and determining why it was wrong.

In the past, understanding a large codebase from scratch was extremely difficult.

In the future, a junior may ask AI to explain specific components, trace relevant functions, and rapidly test hypotheses, allowing them to engage with harder problems much earlier.

In the past, learning advanced exploit techniques could require enormous amounts of solitary trial and error.

AI can compress at least part of that learning cycle.

Of course, using AI for a few months does not make someone a senior engineer.

Seniority does not come from accumulated knowledge alone.

It also comes from experiencing real outages,

living through the consequences of bad decisions,

making consequential calls,

explaining those decisions to others,

and bearing responsibility for the outcomes.

But the speed at which technical knowledge can be acquired may increase dramatically.

That is why I think that, when used well, LLMs could become one of the most powerful ladders to senior-level technical capability we have ever had, rather than merely the technology that destroys that ladder.

Interestingly, ISC2's survey found that 53 percent of respondents believed AI was creating new types of entry-level roles, while 62 percent did not believe AI had reduced the need for cybersecurity fundamentals (ISC2, “Rethinking”).

The real divide may therefore not be between a world with AI and a world without it.

It may be between:

people who use AI to learn faster and people who stop learning because they assume AI will do the learning for them.

In organizations with mature AI transformation environments, juniors may even be able to reach higher levels of technical capability more quickly than previous generations did.

11. That Is Why “Cybersecurity Is No Longer Worth Studying” May Be the Most Dangerous Belief of All

Let us return to the middle school student's original question.

“If AI is eventually going to do cybersecurity for us, why should humans bother studying it?”

Today, I would answer:

“So that you can direct and control the AI.”

In the future, cybersecurity knowledge may no longer be knowledge you need in order to type faster than an AI.

It will increasingly be knowledge you need in order to understand, validate, and control what the AI is doing.

And the knowledge itself is largely the same.

What changes is why you need it.

To direct and control an AI performing security work, someone needs to understand what that AI is actually saying.

They need to answer questions like:

What should the AI investigate?
What access should it be given?
Can this result be trusted?
What might it have missed?
How much autonomous execution should it be allowed?
How should its findings be explained to customers and executives?
Who ultimately bears responsibility for the decision?

Answering those questions still requires humans who understand cybersecurity.

The knowledge required is the same.

What changes is the layer at which that knowledge is applied.

Conclusion: Don't Be Intimidated by AI

I do not want to underestimate AI.

AI is already extraordinary.

And it will become far more capable than it is today.

It will automate a substantial amount of cybersecurity work.

Some existing roles and jobs may genuinely disappear.

Security professionals who insist on working exactly as they always have will face a very difficult period.

But if we jump too quickly from that reality to:

“AI will do everything, so there is no point in studying anymore.”

I believe we will have made one of the most dangerous choices available to us in the AI era.

The first major competition of the future may not even be human versus AI.

It may be security professionals who use AI versus security professionals who do not.

And more importantly:

people who have no choice but to depend on AI versus people who understand AI well enough to direct it.

A company has little reason to hire someone who cannot understand an AI-generated answer and therefore has no choice but to assume that it is correct.

The strongest professionals will still be those who possess deep cybersecurity fundamentals while using AI as an extension of their own minds and hands.

One person like that may be able to perform work that once required several security professionals.

But even that does not automatically tell us what will happen to total employment.

And paradoxically, it is precisely because AI makes individuals so much more capable that we need to study harder.

Not because we need to defeat AI in a competition.

But because we need to become qualified to wield one of the most powerful intellectual tools ever created.

The question future security students should ask is therefore changing.

Not:

“Can I become better than AI at finding vulnerabilities?”

But:

“In a world where AI can find vulnerabilities for me, am I capable of deciding what it should look for, which conclusions I should trust, and how far I should allow it to act?”

If you want to answer that question with confidence, you still need to study.

You need to study networking.

You need to study operating systems.

You need to study programming.

You need to understand systems.

You need direct experience with both offense and defense.

The value of studying cybersecurity is not disappearing in the AI era.

The layer at which that knowledge is used is simply moving upward—from manual analysis toward validation, judgment, and orchestration.

That is all.

And at that higher layer, cybersecurity fundamentals become more important, not less.

Before worrying about a future in which AI makes security professionals unnecessary, we should ask something simpler:

Can someone who does not understand cybersecurity responsibly control an AI that does?

And:

Will that person really be chosen over someone who possesses both deep fundamentals and strong AI skills?

For now, the answer seems fairly clear.

Studying cybersecurity today is not a late bet.

If anything, the stronger AI becomes, the fewer reasons we have to stop learning.

Works Cited

Aldasoro, Iñaki, et al. “AI Adoption, Productivity and Employment: Evidence from European Firms.” BIS Working Papers, no. 1325, Bank for International Settlements, 23 Jan. 2026.

Anthropic. “Partnering with Mozilla to Improve Firefox’s Security.” Anthropic, 6 Mar. 2026. Accessed 31 Aug. 2026.

Bessen, James. “AI and Jobs: The Role of Demand.” NBER Working Paper, no. 24235, National Bureau of Economic Research, Jan. 2018. DOI 10.3386/w24235.

Bessen, James. “Toil and Technology.” Finance & Development, vol. 52, no. 1, Mar. 2015, pp. 16–19.

Booth, Harold, et al. “Accelerating the Adoption of Software and Artificial Intelligence Agent Identity and Authorization.” Concept Paper, National Institute of Standards and Technology, 5 Feb. 2026.

Carlini, Nicholas, et al. “Assessing Claude Mythos Preview’s Cybersecurity Capabilities.” Anthropic, 7 Apr. 2026. Accessed 31 Aug. 2026.

ISC2. “2025 ISC2 Cybersecurity Workforce Study.” ISC2, 4 Dec. 2025. Accessed 31 Aug. 2026.

ISC2. “Rethinking AI’s Impact on Cybersecurity Roles.” ISC2, 14 July 2026. Accessed 31 Aug. 2026.

Liu, Fengyu, et al. “AgentCyberRange: Benchmarking Frontier AI Systems in Realistic Cyber Ranges.” arXiv, 12 June 2026, arXiv:2606.14295.

Liu, Shukai, et al. “Context as a Tool: Context Management for Long-Horizon SWE-Agents.” Findings of the Association for Computational Linguistics: ACL 2026, Association for Computational Linguistics, July 2026, pp. 20604–20617. DOI 10.18653/v1/2026.findings-acl.1032.

Nonaka, Ikujiro. “The Knowledge-Creating Company.” Harvard Business Review, July–Aug. 2007. Accessed 31 Aug. 2026.

Pascoe, Cherilyn, Stephen Quinn, and Karen Scarfone. The NIST Cybersecurity Framework (CSF) 2.0. NIST CSWP 29, National Institute of Standards and Technology, 26 Feb. 2024. DOI 10.6028/NIST.CSWP.29.

Tabassi, Elham. Artificial Intelligence Risk Management Framework (AI RMF 1.0). NIST AI 100-1, National Institute of Standards and Technology, 26 Jan. 2023. DOI 10.6028/NIST.AI.100-1.

World Economic Forum. Global Cybersecurity Outlook 2026. World Economic Forum, 12 Jan. 2026.

남창우. AI의 거시경제 영향 분석 [Analysis of AI’s Macroeconomic Impact]. 연구보고서 2026-01, 한국개발연구원 [Korea Development Institute], 20 July 2026.