Durable Cybersecurity Skills in the Age of AI

What skills will resist devaluation in the age of AI?

As in many professions that come into contact with AI, the roles for humans in cybersecurity will change (and quite possibly be reduced), with the exact impact varying based on the specific job. My goal here is to identify a set of durable skills that will hold up under the pressure of AI, gaining relative value as more fragile skills are automated away.

My motivation to write about this is selfish. I want to stay relevant and employed and it’s hard not to be concerned with the onslaught of claims about how AI is coming for desk jobs like my own. I also worry more about what my children should focus on to have a career that provides fulfillment (intellectual, moral, spiritual) and earnings for them to lead a happy life – whatever that means to them.

It used to be that automation was coming for those activities that humans can’t do. Things like lifting heavy objects, scanning huge amounts of text, transporting things very fast, multiplying huge numbers together, to name a few. Humans can do these things in limited ways, but machines are clearly better suited – machines can be stronger, faster, and more precise than humans.

Automation through AI is encroaching on the thing that we thought only humans could do – to think. It is common that people think that everyone’s job except their own is at risk, plus we tend to over-emphasize the near-term effects (because AI can or can’t do task A now it is going to completely replace job X or never replace job X) while underestimating the longer-term impacts of compounding incremental gains.

Identifying Durable Skills

But surely there are some durables skills that will be key to harnessing AI and applying it to the tough problems we face in cybersecurity and other areas, right?. Let’s consider a durable skill to be one that meets one or more of the following criteria:

1. Relevant to understanding/evaluating AI.
2. Relevant to optimizing our benefits from AI (this includes controlling AI).
3. Hard or undesirable to replace with AI.

Controlling AI is central to my thinking (although a lot of people aren’t as concerned – see OpenClaw). In their current form, LLMs have the fundamental flaw that they mix data and control channels. LLMs don’t inherently distinguish between instructions from the system developer (system prompts, guardrails) and untrusted user data (user input, retrieved documents, web pages, emails, PDFs). To the model, it’s all just text tokens in a single stream. The AI labs have layered on checks to catch malicious input (e.g., jailbreak attempts) and this has helped significantly but these are reactive, bolt-on measures that don’t solve the fundamental issue of mixing data and instructions.

Add to that the fact that LLMs are by design non-deterministic, operating on statistical models and giving different answers to the same request. This all leads to the need to build controls around today’s AI models, which requires knowledge of data storage and governance, networking, digital identity, and other areas mentioned later in this article.

A first pass

Another form of our original question: if I’m in university, what skills and knowledge should I build that are likely to remain relevant, at least over the next 10 years, to a career in cybersecurity? It turns out that the strategy for an experienced professional to stay relevant is largely the same for someone just starting out. The threat of AI-based automation forces all of us to strip away the fluff and look at what truly matters in the job we are doing.

A quick note about “taste”, which I hear discussed a lot but it is not in my list. I think it is important. I think you can learn and develop taste (aka, judgement) but it is a squishy concept and something that develops over time as you learn various skills and gain experience. Telling someone to learn taste is akin to telling someone to “be better” – valid, not helpful.

With that said, let’s think through some skills and knowledge that will be valuable to someone who is looking to stay relevant (or move into) the cybersecurity field as AI continues to advance.

Ethical Frameworks

As the ability to code becomes ubiquitous and software volumes grow, the more scarce becomes responsible decision-making and the ability to think in terms of privacy, risk trade-offs, fairness, accountability, and governance. You need to have some grounding in ethics to participate in these decisions, starting with an understanding of the long-term and short-term risks and benefits associated with AI.

In the long term, many AI leaders say there is a significant non-zero chance that it will destroy humanity. Notably Dario Amodei, the head of Anthropic has said “there’s a 25% chance that things go really, really badly”. The importance of addressing AI alignment and risks to humanity are understandably important but are hard to tackle given the uncertainty of how AI will develop and at what pace.

There are many more near-term and well-understood issues to grapple with including inequality, erosion of trust in institutions, and public health. AI systems are making decisions on what information is available on your news sites, what medical treatments your doctor prescribes, and who gets insurance coverage.

Systems Thinking

You need the ability to analyze and break down a service as a connected system of applications, data sources, actors, and operational processes that interact dynamically. Something might be labelled an AI app/service/agent/etc. but it is not just a large language model – it will have browser UI components, a means to store memory and user-supplied content, logging and monitoring infrastructure, an identity provider… to name a few.

Vulnerabilities often emerge from connections, dependencies, and feedback loops across the entire environment, not just individual software flaws. Not all components of the system have the same value or exposure, and you need to focus your efforts on those that have the highest leverage for increasing overall security.

Computer Organization and Operating Systems

An LLM, like any application, ultimately runs on some form of compute (commonly in the cloud but not always) managed by an operating system. Understanding how and where this occurs is critical to understanding what you need to protect. This can be especially relevant when thinking about how to make a system resilient, highly-available, and cost/energy-efficient.

Real-time Human Communication

A large portion of my week is spent explaining – for example: the design of a system or the implications of a new vulnerability. Until customer organizations and their vendors just let their AIs talk to each other, you will have to present threats, solutions, and explanations to a range of stakeholders and be able to respond to their questions and concerns in real-time.

Real-time is the key here. AI is better than most humans at explaining complex topics but (at least today) you remain accountable for your ideas and work and AI can’t be there to speak (and I mean literally speak) on your behalf. Paradoxically, one of the best ways to get better at communication is to practice writing without AI assistance but you must know your work will be analyzed by others who will use AI. The best advice I can give here is to always write your first drafts without AI, then use AI as an editor to give you feedback.

Data Storage and Governance

AI feeds off data. Putting pre-built LLMs to effective use involves granting them access to organizational data, which may be stored in file systems, databases, and various other locations. The ingestion of data (from sources of varying trustworthiness) and the routing of this data to users and other systems are key sources of vulnerabilities. Protecting and controlling the flow of this data is paramount as it is central to most organizations’ competitive advantage. It is almost impossible to regain control over data once it is leaked

Networking

IP networks are the plumbing that underpins all connected systems, including AI systems. The OSI model has remained relevant throughout my career while a lot of other things have faded (memory management, various programming languages, etc.). Most communication between AI agents and data sources, users, and other agents happens over TCP/IP. A network boundary is one of the key aspects of any system’s control plane and I’d argue an increasingly important one as we have less ability to constrain AI behaviour through software.

Digital Identity

Alongside networking, identity is a key aspect of the control plane for an AI system. It can constrain what an AI system can access and provide a critical off switch. There is also a lot of heterogeneity between organizations’ identity systems, something likely to persist since the cost and complexity of switching identity platforms is very high. Integrating systems (involving AI or not) across organizations (even between departments in the same organization) is complicated and involves thoughtful design of authentication and authorization mechanisms.

AI Integration

Similar to programming, if you don’t understand how a system is built it is harder to secure it. Learn how to integrate an AI agent into an application by building an AI-powered application in a lab environment. You will be more credible and effective if you know how they are built.

Programming Fundamentals

You may never need to code something from “by hand” (I’d argue that has been the case for a while), but knowing the fundamentals of programming is key to understanding software vulnerabilities. You need to be able to interpret and prioritize vulnerabilities (likely found via an AI-based tool) in the massive volume of AI-generated code that organizations are deploying. In a small but important number of cases you will need to be able to go into the code to understand the issue and proposed fix.

Final Thoughts

There’s a lot of justified anxiety about what cybersecurity and similar tech careers will look like in the future and what skills to build and maintain. I can’t remember any period with this level of uncertainty but I’m reminded of the early 2000s when I was a programmer and back then I had the negative view that all programming jobs would be offshored and that prospects were limited.

This was a major factor in me moving away from pure programming and eventually into consulting, which has worked out for me but when I look back my fears were largely unfounded. There was such an explosion of software that even though plenty of it moved offshore, there was still high demand for programmers. Had I stayed a programmer and continued to hone my craft, I bet I would have been just fine for three decades, and perhaps more. Now AI is upending programming and many other fields in its own unique way, but it’s impossible to predict how this will play out. There are credible predictions of AI significantly reducing tech jobs and predictions of it significantly growing them but the most extreme predictions in both directions are likely to be wrong.

I’ll leave you with a mindset that I find helps: be So Good They Can’t Ignore You (from the book by Cal Newport, with the title coming from a quote by comedian Steve Martin). The book argues you should focus on mastery of something vs. finding your passion, but I find it useful in this AI age. For me (and apparently many others), “finding your passion” is full of uncertainty and anxiety, especially when you’re young. AI has a similar effect. But if you focus on being good at something, whether that be programming or UI design or penetration testing or whatever (learning how to leverage AI along the way), even if the demand for that area is reduced you will be in a better position than if you jump around and keep trying to guess at what will be the most in-demand area five years from now. If people know you as someone who can get really good at something they will know you can get really good at some adjacent job.