I think we can all tell stories of the paper-certs that we've encountered in the field. It's frustrating because I know the sweat equity that I put into attaining and keeping my certs - in fact, I go through the material every time I renew, just so I can make sure I remember the things I may not be sharp with.
When I recertify for something I've certified in previously, I just read the exam objectives and brush up on the 10%-15% that has changed. I took the current Net+ and Sec+ without even looking at the exam objectives.
It's a mindset. But again, it comes down to that sense of entitlement.
I remember a local area college here (some time ago) in Colorado Springs that would advertise, "Get your MCSE and make $65,000 per year!" as a line to drive enrollments. A lot of students went there and didn't walk away with their MCSE. They sued the school for false advertising, as if paying their tuition automatically granted them a cert and a salary. So the schools were to blame because they wanted enrollments.
I see ads like that online all the time. Take our training and go from zero to hero in six weeks. You can be a cybersecurity professional!
Except you can't. No one can in six weeks. No company is dumb enough to hire someone with zero practical technical experience for a cybersecurity job. That's a mid-career option, not an entry-level job. Certifications are not a substitute for experience. They are a validation of knowledge.
The students were also to blame for mismanaged expectations. I had one student in my program threaten to sue because they weren't prepared to take the Network+ after the six week course. He cited the instructor and the curriculum. But he didn't realize that I was wise to the fact to the fact that he wasn't even engaged in the course. Turns out, he spent most every day on Facebook or other social media, getting a little too friendly with the lady-folk and not paying attention to the intricacies of the OSI model. But somehow it was OUR fault. Well, the threats didn't go anywhere, particularly when I crafted a catch up plan for him. He didn't want to do the work, but he did want the cert and thought by parking his stupid rump in a chair in a Net+ classroom, he'd get the information by osmosis or something.
It's a story, both common and annoying, of which we all can speak to.
/r
I blame training companies and educational institutions for LYING to students. I'm tired of sugar coating it. They're not exaggerating. They're lying.
The path to a cybersecurity career begins with grunt work. Help desk, desktop support, computer repair, and basic networking. Then moving into slightly more technical work, including work with servers and automation. Maybe they have enough experience five years into their career before someone gives them a break in cybersecurity.
I don't care if they crammed their way to a CISSP and are in the top 1% on HackTheBox. Little to no experience equates to little to no chance you're worth hiring. And college degrees for IT aren't worth the paper they're printed on without real-world, professional experience. A bachelor's degree can't even guarantee a help desk job, and going straight from a bachelor's to a master's with no work experience means that you paid a fortune to compete for entry-level jobs with high school grads with a few certs.
AI will eliminate a lot of entry-level jobs, so the younger generations will have to develop a work ethic in overdrive or pick a different career. The high skill jobs will suffer more, as fewer and fewer people are added to the talent pipeline. For us, more seasoned technical folks, we'll be fine through retirement because no one can do what we do. But I have doubts about the future.