The market value of a skill can disappear much faster than the knowledge behind it. And in cybersecurity, we may be approaching a point where the people who know how to find vulnerabilities are becoming less valuable, while the people who understand why systems fail become more important.
A friend of mine used to make $200,000 a year from bug bounties.
He was good at what he did. He knew how to look at applications, understand their behavior, identify weaknesses, and find vulnerabilities that others had missed. It was not luck. It was years of accumulated experience, persistence, and an ability to think differently from the people who built the systems.
Today, he only makes $100,000.
He hasn't suddenly become a worse researcher. The market around him has changed.
There are more researchers competing for the same targets. Automation has made some parts of vulnerability discovery faster. AI tools are increasingly capable of assisting with code analysis, identifying suspicious patterns, and exploring potential weaknesses.
None of these changes alone explains an individual's income. But together, they illustrate something important: the economic value of a skill can change even when the skill itself remains valuable.
This is not a story about one researcher losing his edge. It is a glimpse of what may happen to many cybersecurity careers.
And it raises a much bigger question:
If you're building a career in cybersecurity today, where should you invest the next five years?
The market is changing faster than the career paths
For years, cybersecurity offered relatively clear ways to build a career.
You could start with networking, systems administration, software development, or IT operations. You could move into penetration testing, security engineering, incident response, vulnerability research, or architecture.
You learned the fundamentals, gained experience, collected a few certifications, and gradually developed the judgment that comes from working with real systems.
That model was never perfect. But it gave people a path.
AI is disrupting parts of that path.
Tasks that once required considerable manual effort can now be accelerated or partially automated. Code review, log analysis, basic vulnerability discovery, report writing, reconnaissance, and repetitive testing are all being affected.
This does not mean these activities will disappear. It means that performing them is becoming less distinctive.
When more people can produce similar results with the assistance of AI, the market has less reason to reward the activity at the same rate.
This is the uncomfortable part of technological progress: it does not necessarily make experienced people less capable. It can make the capabilities they spent years developing less scarce.
And scarcity has always been part of what determines economic value.
Don't confuse a growing market with a safe career
Whenever a new technology appears, a new collection of job titles follows.
AI Security Engineer. AI Red Teamer. LLM Security Researcher. AI Governance Specialist.
These are legitimate areas of work. They will create opportunities, and organizations will need people who understand the risks of AI systems.
But I would be careful about treating any emerging specialty as a safe place to hide from automation.
Today's difficult task can become tomorrow's automated workflow.
Prompt injection research, model testing, AI-assisted vulnerability discovery, and security evaluations are already evolving rapidly. The tools will improve. The techniques will become more accessible. The competition will increase.
The same economic forces affecting traditional vulnerability research can eventually affect AI security research too.
Changing your job title does not necessarily change your exposure to automation.
The more useful question is not which security specialty is fashionable today. It is which capabilities will remain valuable as the tools become better.
I would put my attention on several areas.
1. Understand systems, not just security tools
This is probably the most important investment.
Learn operating systems, networking, programming languages, databases, distributed systems, application architecture, and the infrastructure that holds everything together.
Not just how to use a scanner. Understand what the scanner is examining.
Not just how to exploit a vulnerability. Understand the assumptions that made the vulnerability possible.
Not just how to configure a firewall. Understand the communication patterns, trust boundaries, and failure modes of the system behind it.
AI can help explain code, generate scripts, and identify suspicious behavior. But the quality of its conclusions depends heavily on the context it receives and the ability of someone to evaluate the result.
The person who understands the system can ask better questions, recognize incorrect conclusions, and see weaknesses that are invisible when looking at isolated pieces of code.
Tools will keep changing. Systems knowledge compounds.
2. Move closer to architecture and design
Finding a vulnerability is important. Preventing entire classes of vulnerabilities is a different level of work.
Product security and secure architecture require people to understand how software is designed, how business requirements influence implementation, how identities and permissions are managed, and how components interact.
A system can pass hundreds of automated security checks and still be fundamentally insecure.
The weakness may be in the authorization model, a business process, an assumption about user behavior, or the way two perfectly legitimate components interact.
These problems are difficult because they rarely exist in one line of code.
They exist in the space between components, teams, requirements, and decisions.
As AI makes software development faster, the ability to reason about the security of the whole system may become even more valuable.
Generating code is not the same as designing a system that deserves to be trusted.
3. Learn cloud, infrastructure, and identity security
The digital world is becoming increasingly dependent on cloud infrastructure, distributed services, APIs, and automated identities.
AI agents will add another dimension to this.
An agent may be able to access internal systems, call APIs, retrieve information, execute actions, and interact with other agents. That creates difficult questions about identity, permissions, delegation, credentials, isolation, and accountability.
Who authorized the action?
What should the agent be allowed to access?
Can its permissions be abused or inherited incorrectly?
How do we establish trust when an autonomous process interacts with multiple systems?
These are not merely AI questions. They are extensions of problems that have existed in distributed computing for years.
People who understand identity, infrastructure, access control, and system boundaries will have a useful foundation for dealing with them.
4. Go beyond finding individual vulnerabilities
I don't think vulnerability research is becoming irrelevant. I think the nature of valuable research is changing.
Finding a familiar vulnerability in a familiar pattern may become increasingly automated.
But understanding an undocumented protocol, discovering an unexpected interaction between components, constructing a complex exploit chain, or identifying a flaw in a system's underlying assumptions is a different challenge.
It requires more than pattern matching.
It requires curiosity, patience, creativity, and a deep understanding of how things work.
The important distinction is not between manual research and AI-assisted research. It is between someone who can operate a tool and someone who can investigate a problem that the tool does not already understand.
Use AI to accelerate your research. Let it explore possibilities, examine code, and challenge your assumptions.
But don't outsource your judgment.
The researcher who can validate a result, understand its implications, and discover what the model overlooked will have an advantage over someone who simply accepts whatever the tool produces.
5. Become better at working with AI, without becoming dependent on it
There is little value in pretending AI does not exist.
Security professionals should learn how to use it effectively: for code analysis, reverse engineering, research, automation, incident investigation, and understanding unfamiliar technologies.
But there is a difference between using AI to extend your capabilities and relying on it to supply capabilities you never developed.
If you cannot tell whether an answer is correct, you are not really in control of the process.
If you cannot explain why a vulnerability exists, you may struggle when the tool gives you an incorrect explanation.
If you cannot investigate a system without an AI assistant, you may find yourself limited by the same assistant you depend on.
The goal should be to become an engineer or researcher who is more capable because of AI, not someone whose entire expertise disappears when the tool is unavailable.
The problem nobody seems to be discussing: where will the next experts come from?
There is another consequence of automation that worries me more than the disappearance of individual tasks.
How do we develop the next generation of senior security researchers if AI takes over much of the work that junior people used to learn from?
Expertise does not appear overnight.
A good researcher was once a beginner who spent hours examining unfamiliar code, breaking things, making incorrect assumptions, following dead ends, and learning why an approach did not work.
Some of those experiences were frustrating and inefficient. But they were also educational.
You learn to recognize patterns by seeing them repeatedly. You develop intuition by making mistakes and understanding them. You gain judgment by dealing with situations where the answer is not obvious.
Now imagine a junior researcher who asks an AI to analyze every unfamiliar piece of code, identify every suspicious function, suggest every test case, and explain every result.
The work gets done faster.
But what happens to the learning process?
If the junior researcher never develops the instinct to recognize an unusual behavior, how will that person become the senior researcher who can recognize something genuinely new?
There is a risk that organizations will optimize away the very experiences that produce expertise.
This is not an argument against AI-assisted learning. Quite the opposite. AI can be an excellent mentor, research assistant, and learning accelerator.
But organizations need to think carefully about the difference between automating work and automating the development of people.
A team that becomes more productive today may be creating a talent shortage for tomorrow.
The uncomfortable economics of expertise
There is a broader lesson here that extends beyond cybersecurity.
Technology does not always eliminate expertise. Sometimes it changes which parts of expertise are economically rewarded.
When calculators became widespread, arithmetic did not become useless. But being able to perform calculations quickly became less valuable.
When search engines became common, memorizing large amounts of information became less distinctive. Knowing how to find, interpret, and evaluate information became more important.
AI may be doing something similar to technical work.
The ability to produce an answer is becoming cheaper. The ability to determine whether that answer is correct, understand its consequences, and make a sound decision is becoming more important.
This does not mean judgment is immune to automation. It means that, for now, the strongest position is likely to be built on a combination of deep technical knowledge, sound judgment, and effective use of AI.
And even that advantage will need to evolve.
The friend who once earned $200,000 from bug bounties is a useful reminder. Being good at something does not guarantee that the market will continue to reward it in the same way.
A career built entirely around one technique, one tool, one platform, or one fashionable specialty is fragile.
The technology will change. The market will change. The competition will change.
So, where should you invest the next five years?
My answer is not to chase the next big cybersecurity job title.
Build a foundation that allows you to move between specialties as the industry changes.
Understand software and systems deeply. Learn how architecture, infrastructure, identity, and business logic fit together. Develop the ability to investigate unfamiliar problems. Become comfortable using AI, but retain the judgment to challenge it.
And keep solving difficult problems.
Not because every problem will lead to a bounty, a certificate, a promotion, or a line on your résumé. But because the process develops something that is difficult to acquire through shortcuts: an understanding of how the digital world actually behaves.
It's hard to predict which cybersecurity jobs will be the most lucrative in 2030.
Some roles that look essential today may become ordinary. Some specialties that barely exist today may become critical. And some of the most valuable people may not fit neatly into any job title we currently recognize.
But I suspect one distinction will matter more than ever:
There will be people who know how to operate increasingly powerful tools, and people who understand what to do when those tools are wrong, incomplete, or facing something they have never seen before.
I'd rather build a career around being the second kind.
Because today's competitive advantage may become tomorrow's commodity.
And the most dangerous career decision may be assuming that what makes you valuable today will make you valuable forever.
---
The tools will keep getting smarter. The question is whether we will keep getting wiser.
No comments:
Post a Comment