New research out today from Rogers Cybersecure Catalyst at Toronto Metropolitan University (“the Catalyst”), funded by the Future Skills Centre through the Government of Canada’s Future Skills Program, examines how AI is changing the work traditionally done by early-career cybersecurity professionals and what that could mean for how they build foundational skills and experience.
The report, Preserving Foundational Skills in AI-Enabled Early-Career Cybersecurity Work, explores how the growing use of AI in cybersecurity could affect entry-level roles, learning opportunities, and the pathways through which new professionals develop their expertise.
The “entry-level paradox”
Employers described a shift in traditional Level 1 cybersecurity work, with tasks such as alert triage, query writing, and incident investigation increasingly automated or AI-assisted. As a result, early-career professionals are taking on more complex investigations, exercising greater judgment, and navigating business and operational context earlier in their careers. Some employers are describing this as “Level 1.5” roles. This shift is creating an “entry-level paradox” where employers want job-ready cybersecurity talent, while AI is reshaping the routine tasks through which newcomers have traditionally become job-ready.
Several employers raised concerns about a potential “loss of practice,” as AI reduces opportunities to independently perform the tasks that build technical knowledge, problem-solving skills, and professional judgment. At the same time, the research points to a broader shift in the capabilities employers value. While 64% of consultation responses identified foundational technical and IT knowledge as important, 93% of employers identified human-centred capabilities (commonly referred to as “soft skills”) as increasingly important, including communication skills (36%), stakeholder management (27%) and critical thinking (18%).
AI literacy is not a stand-alone skill. Professionals need to know how to use AI appropriately in the context of their specific tasks. And they need to have these role-specific technical AI skills in combination with communications skills, collaborative abilities, and an ability to think critically about problems.
Rethinking how cybersecurity talent is assessed and developed
These changing expectations also have implications for how cybersecurity professionals are assessed and hired. Nearly 1 in 3 employers raised concerns about assessment and hiring practices as candidates increasingly use AI during technical assessments, certifications, and interviews. Employers questioned whether traditional credentials and assessments provide enough evidence of workplace readiness, and many expressed growing interest in more applied ways of demonstrating readiness, including:
Proof of work (concrete evidence of a candidate’s applied skills and capabilities, like technical portfolios)
Simulations (practical scenarios that assess how candidates apply their skills in realistic situations)
Scenario-based assessments (assessing how candidates approach realistic challenges with and without AI)
Participants also highlighted governance, risk, and practical risk decision-making as increasingly important. Early-career professionals may need to understand not only how to identify technical risks but also how to assess, communicate, and manage those risks within a broader business context.
The research points to a need for employers, educators, and training providers to rethink what “job-ready” means, how job readiness is assessed, and how early-career professionals can build and demonstrate the capabilities needed to succeed as AI changes traditional pathways into cybersecurity. This includes creating more opportunities for hands-on learning and operational experience, using applied assessments that test reasoning and judgment with and without AI, and preparing professionals to validate AI outputs, understand risk, and apply human judgment.
The Catalyst tested these approaches through two pilot training iterations involving 55 early-career cybersecurity professionals, using hands-on simulations, a tabletop exercise, and an AI literacy lab to practice these skills in realistic scenarios.
Ultimately, the research suggests that AI is not eliminating early-career cybersecurity roles but reshaping the work, pathways, and opportunities through which the next generation of cybersecurity professionals develops experience. As those pathways evolve, employers and educators will need to ensure that AI-driven efficiency is matched by meaningful opportunities to learn, practice, and demonstrate the skills cybersecurity work still depends on.
The full report available here

Rogers Cybersecure Catalyst expands real-world cybersecurity training across Canada with the support of Google.org
Posted in Commentary with tags Rogers on October 14, 2026 by itnerdRogers Cybersecure Catalyst at Toronto Metropolitan University (“the Catalyst”) announced today the launch of Cyber Clinics Canada, a major national initiative to expand the cyber clinic model across the country. Backed by $3.5 CAD million in funding from Google.org, including $1 million for the Catalyst, the initiative will bring Canadian postsecondary institutions together to give learners hands-on cybersecurity experience while providing more community organizations with access to critical cybersecurity support.
Cyber clinics are hands-on learning programs that pair cybersecurity learners with nonprofit and social impact organizations that need cybersecurity support. Working under the guidance of experienced professionals, learners gain meaningful, practical experience while organizations receive free cybersecurity support they may not otherwise be able to afford.
In 2025, the Catalyst launched its own cyber clinic. With support from Google.org, Cyber Clinics Canada will build on that foundation to expand the model nationwide. As the network’s central hub, the Catalyst will bring participating institutions together and provide shared tools, resources, and support to help them launch and operate high-quality clinics in their own communities.
Cyber clinics are already gaining momentum worldwide, with 61 cyber clinics across eight countries. Cyber Clinics Canada will build on that momentum by creating a connected national network where institutions can share expertise, collaborate, and strengthen their programs. The initiative will also equip institutions with the tools and knowledge to launch their own cyber clinics, creating more opportunities for learners to gain real-world experience and build Canada’s cybersecurity workforce.
To learn more about Cyber Clinics Canada and how your institution can participate, visit cyberclinics.ca.
Leave a comment »