New research out today from Rogers Cybersecure Catalyst at Toronto Metropolitan University (“the Catalyst”), funded by the Future Skills Centre through the Government of Canada’s Future Skills Program, examines how AI is changing the work traditionally done by early-career cybersecurity professionals and what that could mean for how they build foundational skills and experience.
The report, Preserving Foundational Skills in AI-Enabled Early-Career Cybersecurity Work, explores how the growing use of AI in cybersecurity could affect entry-level roles, learning opportunities, and the pathways through which new professionals develop their expertise.
The “entry-level paradox”
Employers described a shift in traditional Level 1 cybersecurity work, with tasks such as alert triage, query writing, and incident investigation increasingly automated or AI-assisted. As a result, early-career professionals are taking on more complex investigations, exercising greater judgment, and navigating business and operational context earlier in their careers. Some employers are describing this as “Level 1.5” roles. This shift is creating an “entry-level paradox” where employers want job-ready cybersecurity talent, while AI is reshaping the routine tasks through which newcomers have traditionally become job-ready.
Several employers raised concerns about a potential “loss of practice,” as AI reduces opportunities to independently perform the tasks that build technical knowledge, problem-solving skills, and professional judgment. At the same time, the research points to a broader shift in the capabilities employers value. While 64% of consultation responses identified foundational technical and IT knowledge as important, 93% of employers identified human-centred capabilities (commonly referred to as “soft skills”) as increasingly important, including communication skills (36%), stakeholder management (27%) and critical thinking (18%).
AI literacy is not a stand-alone skill. Professionals need to know how to use AI appropriately in the context of their specific tasks. And they need to have these role-specific technical AI skills in combination with communications skills, collaborative abilities, and an ability to think critically about problems.
Rethinking how cybersecurity talent is assessed and developed
These changing expectations also have implications for how cybersecurity professionals are assessed and hired. Nearly 1 in 3 employers raised concerns about assessment and hiring practices as candidates increasingly use AI during technical assessments, certifications, and interviews. Employers questioned whether traditional credentials and assessments provide enough evidence of workplace readiness, and many expressed growing interest in more applied ways of demonstrating readiness, including:
Proof of work (concrete evidence of a candidate’s applied skills and capabilities, like technical portfolios)
Simulations (practical scenarios that assess how candidates apply their skills in realistic situations)
Scenario-based assessments (assessing how candidates approach realistic challenges with and without AI)
Participants also highlighted governance, risk, and practical risk decision-making as increasingly important. Early-career professionals may need to understand not only how to identify technical risks but also how to assess, communicate, and manage those risks within a broader business context.
The research points to a need for employers, educators, and training providers to rethink what “job-ready” means, how job readiness is assessed, and how early-career professionals can build and demonstrate the capabilities needed to succeed as AI changes traditional pathways into cybersecurity. This includes creating more opportunities for hands-on learning and operational experience, using applied assessments that test reasoning and judgment with and without AI, and preparing professionals to validate AI outputs, understand risk, and apply human judgment.
The Catalyst tested these approaches through two pilot training iterations involving 55 early-career cybersecurity professionals, using hands-on simulations, a tabletop exercise, and an AI literacy lab to practice these skills in realistic scenarios.
Ultimately, the research suggests that AI is not eliminating early-career cybersecurity roles but reshaping the work, pathways, and opportunities through which the next generation of cybersecurity professionals develops experience. As those pathways evolve, employers and educators will need to ensure that AI-driven efficiency is matched by meaningful opportunities to learn, practice, and demonstrate the skills cybersecurity work still depends on.
The full report available here
Related
This entry was posted on October 7, 2026 at 9:15 am and is filed under Commentary with tags Rogers. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
93% of Employers Say Human-Centered Skills Are More Important as AI Reshapes Cybersecurity
New research out today from Rogers Cybersecure Catalyst at Toronto Metropolitan University (“the Catalyst”), funded by the Future Skills Centre through the Government of Canada’s Future Skills Program, examines how AI is changing the work traditionally done by early-career cybersecurity professionals and what that could mean for how they build foundational skills and experience.
The report, Preserving Foundational Skills in AI-Enabled Early-Career Cybersecurity Work, explores how the growing use of AI in cybersecurity could affect entry-level roles, learning opportunities, and the pathways through which new professionals develop their expertise.
The “entry-level paradox”
Employers described a shift in traditional Level 1 cybersecurity work, with tasks such as alert triage, query writing, and incident investigation increasingly automated or AI-assisted. As a result, early-career professionals are taking on more complex investigations, exercising greater judgment, and navigating business and operational context earlier in their careers. Some employers are describing this as “Level 1.5” roles. This shift is creating an “entry-level paradox” where employers want job-ready cybersecurity talent, while AI is reshaping the routine tasks through which newcomers have traditionally become job-ready.
Several employers raised concerns about a potential “loss of practice,” as AI reduces opportunities to independently perform the tasks that build technical knowledge, problem-solving skills, and professional judgment. At the same time, the research points to a broader shift in the capabilities employers value. While 64% of consultation responses identified foundational technical and IT knowledge as important, 93% of employers identified human-centred capabilities (commonly referred to as “soft skills”) as increasingly important, including communication skills (36%), stakeholder management (27%) and critical thinking (18%).
AI literacy is not a stand-alone skill. Professionals need to know how to use AI appropriately in the context of their specific tasks. And they need to have these role-specific technical AI skills in combination with communications skills, collaborative abilities, and an ability to think critically about problems.
Rethinking how cybersecurity talent is assessed and developed
These changing expectations also have implications for how cybersecurity professionals are assessed and hired. Nearly 1 in 3 employers raised concerns about assessment and hiring practices as candidates increasingly use AI during technical assessments, certifications, and interviews. Employers questioned whether traditional credentials and assessments provide enough evidence of workplace readiness, and many expressed growing interest in more applied ways of demonstrating readiness, including:
Proof of work (concrete evidence of a candidate’s applied skills and capabilities, like technical portfolios)
Simulations (practical scenarios that assess how candidates apply their skills in realistic situations)
Scenario-based assessments (assessing how candidates approach realistic challenges with and without AI)
Participants also highlighted governance, risk, and practical risk decision-making as increasingly important. Early-career professionals may need to understand not only how to identify technical risks but also how to assess, communicate, and manage those risks within a broader business context.
The research points to a need for employers, educators, and training providers to rethink what “job-ready” means, how job readiness is assessed, and how early-career professionals can build and demonstrate the capabilities needed to succeed as AI changes traditional pathways into cybersecurity. This includes creating more opportunities for hands-on learning and operational experience, using applied assessments that test reasoning and judgment with and without AI, and preparing professionals to validate AI outputs, understand risk, and apply human judgment.
The Catalyst tested these approaches through two pilot training iterations involving 55 early-career cybersecurity professionals, using hands-on simulations, a tabletop exercise, and an AI literacy lab to practice these skills in realistic scenarios.
Ultimately, the research suggests that AI is not eliminating early-career cybersecurity roles but reshaping the work, pathways, and opportunities through which the next generation of cybersecurity professionals develops experience. As those pathways evolve, employers and educators will need to ensure that AI-driven efficiency is matched by meaningful opportunities to learn, practice, and demonstrate the skills cybersecurity work still depends on.
The full report available here
Share this:
Like this:
Related
This entry was posted on October 7, 2026 at 9:15 am and is filed under Commentary with tags Rogers. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.