Reinforcing the Nation's Cybersecurity Defenses

As cyber threats increasingly challenge global security, the demand for cybersecurity professionals has never been more urgent. Alarmingly, the United States faces a significant shortage of workers in this critical field, with more than half a million cybersecurity jobs going unfilled. Gartner, a leading technology consulting firm, predicts that by 2025, half of all cybersecurity incidents will stem from this lack of skilled talent and human mistakes.

The "experience paradox" in cybersecurity hiring particularly affects career transitions. Despite the desperate need for talent, many organizations refuse to consider entry-level candidates, creating a Catch-22 situation where newcomers can't gain the experience they need to be hired. This challenge is especially frustrating for military community members who possess valuable soft skills and real-world experience but lack specific civilian cybersecurity credentials. Veterans bring extensive experience in protecting sensitive information and responding to threats, while military spouses often excel in rapid adaptation and remote team collaboration—skills increasingly crucial in today's distributed security operations.

Traditional higher education programs often fail to address these challenges. The ISC2 study shows that new entrants to cybersecurity tend to be older, primarily in the 39-49 age range, with work-life balance ranking as their top priority. This aligns with the demographics of military learners - most veterans and active-duty service members are over 35, balancing full-time jobs and family responsibilities. Military spouses face additional challenges, requiring programs flexible enough to accommodate frequent relocations and changing duty stations.

Innovative solutions are emerging across the country. Some institutions are introducing hands-on cybersecurity labs and clinics that provide real-world experience—essential for breaking through the entry-level hiring barrier. These programs allow students to work on actual security challenges, managing security operations centers (SOCs), conducting penetration testing, and implementing security controls in controlled environments. This practical experience helps bridge the gap between theoretical knowledge and job requirements, making graduates more attractive to employers regardless of their formal work history in civilian cybersecurity roles.

Meanwhile, initiatives like the San Diego Cyber Clinic—a partnership between National University, San Diego State University, Cal State San Marcos, and the San Diego Cyber Center of Excellence—provide military learners and other students with real-world experience through student-run cybersecurity clinics. Supported by a generous grant from Google, these clinics offer free services to small businesses and organizations that otherwise couldn't afford cybersecurity expertise while equipping students with practical, career-ready skills.

These initiatives serve a dual purpose: providing students with hands-on experience while offering free security services to small businesses that couldn't otherwise afford such expertise. Similar programs are emerging nationwide, often supported by major technology companies seeking to address the talent pipeline challenge.

States are also taking legislative action. California, Oregon, and Texas now require colleges to offer veterans and active-duty service members priority course registration. Some institutions are going further by embedding Credit for Prior Learning (CPL) in their curricula, allowing veterans to leverage their military experience toward degree requirements. Converting military experience into academic credits streamlines the path to graduation, delivering both time and cost savings that are crucial for working professionals.

The future of cybersecurity education must embrace several key principles:

First, programs need flexible scheduling and delivery methods that accommodate military training and deployment schedules. Online options and shorter course durations are essential for working professionals balancing multiple responsibilities. These students lead busy, complex lives that don’t fit neatly with the traditional structure of most institutions. The challenge is longstanding. The institution where I am employed was established by a veteran in the 1970s precisely to address such issues. When I pursued my bachelor's degree in the early 2000s while serving in the Navy, I realized there was still much room for growth. And even now, the traditional college experience still commonplace at many institutions is not aligned with the needs of these working adults.

Second, hands-on experience must be integrated throughout the curriculum. Lab environments, capture-the-flag competitions, and real-world projects help students develop practical skills while building the portfolio of work experience employers demand. These environments should simulate actual security incidents and tools, preparing students for immediate contribution in security roles.

Third, the cybersecurity industry must fundamentally shift its perspective on entry-level hiring, particularly regarding veterans and military spouses. While these candidates may be new to civilian cybersecurity, they bring valuable experience to the field. Veterans offer years of operating in high-stakes environments, following complex protocols, and rapidly adapting to changing threats. Military spouses contribute exceptional skills in project management, remote collaboration, and adapting to changing environments—capabilities developed through managing complex family logistics across multiple relocations and deployments.

Both groups demonstrate proven ability to learn mission-critical skills under pressure. Veterans bring team leadership and crisis management experience, while military spouses excel at maintaining operational continuity through disruption. Organizations that recognize these unique combinations of transferable skills and learning aptitude often find that military-affiliated employees quickly advance beyond entry-level roles, bringing valuable leadership, adaptability, and operational experience to their cybersecurity teams.

Finally, educational institutions must partner more closely with industry to ensure curriculum alignment with employer needs. This includes regular updates to course content based on emerging threats and technologies, as well as partnerships that create internship and apprenticeship opportunities.

The cybersecurity industry desperately needs the unique combination of skills that the military community brings to the table. Veterans offer discipline, leadership, and mission-focused problem-solving, while military spouses bring adaptability, resilience, and remote work proficiency. By reimagining educational programs to better serve these learners—through practical experience, flexible delivery, and industry partnerships—we can address both the national security imperative of closing the cybersecurity skills gap and the economic opportunity of supporting military families. The solution to our cybersecurity workforce challenge is within reach, but it requires us to think differently about how we educate, prepare, and empower the next generation of security professionals.

Chris Simpson is the Director of National University's Center for Cybersecurity.