Will AI Replace Cybersecurity Jobs? A Reality Check for Beginners and Leaders

Is AI making it pointless to learn cybersecurity? It's a fair question, and a lot of people starting out are asking it quietly. The headlines don't help. New models post impressive benchmark scores, and there are reports of AI systems finding vulnerabilities that humans hadn't spotted yet.

Here's what most people are missing, though. AI replacing cybersecurity tasks is not the same as AI replacing cybersecurity professionals. The harder problem sits somewhere else. If AI takes over the simple work beginners have always learned from, how does the next generation get the experience to become experts?

On the first episode of Living with AI on The Future State, I spoke with TGLOT, a cybersecurity learner and content creator who actually stepped back from a cybersecurity journey because of AI. That story is worth hearing, because it's a lot more common than people admit.

Why one aspiring cybersecurity professional hit pause

TGLOT had already recorded a batch of cybersecurity videos and was ready to publish them. Then came a run of stories about people doing remarkable things with AI. Suddenly a straightforward troubleshooting video felt pointless. Why would anyone watch it when an AI could walk them through the same fix in seconds?

TGLOT had also watched the bug bounty world change. Bug bounty hunters find and report security flaws in software and get paid for it. The "low hanging fruit", the easier bugs that beginners used to cut their teeth on, are now being found and reported quickly with AI help. And people with limited experience are finding bigger bugs than before.

On top of that, smaller cybersecurity creators were drifting toward AI content. That was the most worrying sign of all.

I get it. But a change in what creators talk about doesn't necessarily mean a change in what employers need. Creators follow what people search for. Still, beginners' concerns shouldn't be brushed aside. If technology genuinely changes how entry level work gets done, that has real consequences for how anyone gets into the profession.

What can AI actually do in cybersecurity?

Quite a lot, honestly. AI is already helping teams analyse alerts, review code, investigate incidents and handle reconnaissance. In bug bounty work, much of the manual information gathering that used to take hours is now automated. TGLOT's take was that this isn't all bad. It's clearing out a lot of low effort "script kiddie" activity.

Demonstrated, reliable and trusted are three different things

This is the distinction I'd ask every leader and every learner to hold onto. There's what AI can demonstrate, what it can reliably do, and what organisations are prepared to trust it to do. Those aren't always the same.

A tool might produce a dazzling security analysis in a demo. Real organisations are messier. They have legacy systems, incomplete information, shifting threats, and actual consequences when something goes wrong. Regulation keeps changing too, and it often puts obligations on organisations that can't simply be handed to a model.

Replacing tasks is not replacing professionals

A job isn't one task. It's a bundle of tasks, responsibilities and decisions.

Take a security analyst. AI can summarise a flood of alerts and flag which ones deserve attention first. Useful. But someone still has to understand the organisation, weigh the evidence, judge the risk and decide what happens next. Even where AI does take an action, there's usually a human in the loop approving it, and a human who's accountable if it goes wrong.

I'm not saying human roles are immune to change. Some of those decisions will become more automated over time. My point is that we need to be precise about what is changing. When I put that to TGLOT, we agreed. AI isn't replacing the work itself, it's changing how the work gets done.

The entry-level problem nobody is planning for

This is the part that worries me most. Careers have traditionally started with fairly simple work. You review logs, triage tickets, chase down the obvious issues. Over time you build judgement and take on harder problems.

If organisations automate a big chunk of that introductory work, where does the judgement come from? That's not just a technology question. It's an education question, a workforce question and a leadership question. Someone has to design new routes to experience, and right now very few organisations are doing that deliberately.

TGLOT put the generational shift well. Someone starting in 2015 had limited resources and limited knowledge to draw on. Someone starting now has answers everywhere. But they also face far more competition, because anyone with AI access can enter the field and, in some cases, outperform people with years of experience. The barrier to learning has dropped. The barrier to standing out hasn't.

Is cybersecurity still worth learning?

Picture a 19 year old who's just started on networking, Linux and basic security concepts. They're excited. Then they watch a video claiming AI agents can do the work of an entire security team.

Should they carry on? My answer is yes, if cybersecurity genuinely interests them, as long as they're realistic about how the profession is changing.

Here's why. When an AI produces an answer, that doesn't make the answer correct. If it flags a misconfiguration, you need enough knowledge to check that conclusion. If it writes a script, you need to know what that script does. If it tells you to disable a service or change a security setting, you need to understand what happens when you do. As the tools get more capable, the ability to question their output becomes more valuable, not less.

Here's a simple test before you trust any AI output. Can it do this reliably? Who checks the result? Who's accountable if it's wrong? In security, those questions matter a lot.

The cybersecurity fundamentals that still matter

TGLOT was blunt about this. If your basics aren't solid, no amount of AI will get you where you want to go. Networking comes first, because it shows up in almost everything you do in this field. Operating systems, scripting and authentication sit alongside it.

One myth worth killing: "AI can write code, so I don't need to learn programming." Writing code and understanding code aren't the same thing. AI can produce a script in seconds. If that script contains a vulnerability or pulls in an unexpected dependency, someone has to notice.

How to approach learning cybersecurity with AI

We both agreed you shouldn't pick AI or cybersecurity. Learn them together. Here's how I'd structure it:

1. Fundamentals first. How computers, networks, operating systems and security controls actually work.
2. Hands on practice. Build things and break things safely in an authorised lab. Troubleshoot. Learn how to investigate evidence.
3. AI literacy. Know what the tools do well, where they fail and how to use them without becoming dependent on them.

Using AI to explain a concept you're stuck on? Great. Using it to complete every exercise without understanding the answer? That's a problem. The goal is to become more capable because you use AI, not less capable without it.

Conclusion: the real risk is the broken ladder

So, will AI replace cybersecurity jobs? It will reshape them, and it's already absorbing a lot of routine tasks. But accountability, judgement and context still sit with people, and both law and governance increasingly expect them to. The bigger risk is that we quietly remove the first rungs of the career ladder and only notice when there's no one ready to step into senior roles.

That's a challenge for educators, employers and policymakers, not just for the 19 year old wondering whether to keep going.

Listen to the full episode of Living with AI and subscribe to The Future State newsletter at thefuturestate.net for more conversations on technology, AI, law and leadership.