Cyber Security Certifications: The Good, The Bad, and The Ugly

Tom Kranz, drawing on about thirty years in IT and security, argues that certifications are widely misunderstood by candidates and employers alike. He starts with the history of security credentials, pointing out that the field still lacks a settled definition of its roles, which makes certifications attractive but easy to misread. He criticises popular certification maps and the simple analyst, engineer and architect career model as a poor fit for how people actually work.

The middle of the talk sorts certifications by quality. Credentials he considers worth pursuing include CompTIA Network+ and Security+ for entry level, Cisco's CCNA, ISACA's CISM, the OSCP for hands-on offensive work, and the CISSP for experienced practitioners, provided the candidate already has the years of experience it assumes. He warns against pay-to-play courses, tool-focused training, vendor-specific credentials that can pigeonhole people, and promises of automatic salary increases. He also covers SABSA, TOGAF, SANS GIAC, the free EU-backed Concordia C3 course, university degrees, and CREST, including the reported exam-cheating controversy and its effect on trust in the scheme.

He closes by urging listeners to treat certification as proof of skills they already have rather than a shortcut into a job. Practical exams and continuing education make a credential meaningful, while a certification that never expires says little about current ability. He points to a separate interview workshop for more detailed career advice.