Should I Guide My Kids into Cybersecurity?

Children naturally follow in the footsteps of their parents. We learn this early through stories from an early age: the farmer's lineage farmed, the baker's lineage baked, and craft was passed hand-to-hand. That pattern survived the industrial revolution and remains alive and well today. How many teachers, attorneys, or electricians do you know whose kids entered "the family trade"?

But cybersecurity exists inside a corporate reality that many newcomers overlook: the purpose of any business is profit. In market capitalism, you either create value efficiently enough that someone pays you more than the delivery cost, or you cease to exist. Ask the IRS — file a Schedule C showing losses three years running, and they'll politely inform you that you don't run an enterprise; you have an expensive hobby.

Why connect family trades and P&L statements to cybersecurity? Because most practitioners sign up out of genuine passion for the craft, only to slam headfirst into enterprise mechanics. We enter a high-friction arena where success is invisible, failure is headline news, and our alert queues are drowning under AI-accelerated vulnerability disclosures — even when we haven't made a single operational mistake.

So, when I contemplate the question of would I steer my own children down this path, my answer is simple: it depends.

Not because the profession lacks viability, and not out of existential dread over LLMs automating our seats. It depends because, after years spent primarily on the Blue Team side of the house, I know what the grind actually costs.

Inevitably practitioners will one day hear: "Don't be the Department of No." Yet their immediate reaction is entirely fair: "If we can't say no, how do we enforce security?" The very tools of our trade — IAM boundaries, RBAC matrices, Zero Trust perimeters — rely on establishing hard stops. The systemic disconnect is that too many engineers believe they were hired to create absolute security, when the enterprise actually hired them for adequate risk mitigation.

That failure doesn't rest solely on the practitioners. It sits squarely with the surrounding ecosystem: academic degree mills peddling unrealistic expectations, cyber insurers underwriting operational debt, MSPs marketing silver-bullet tools, and executive suites that treat defense as a check-the-box overhead expense.

This misalignment breeds the exact toil, cynicism, and burnout currently hollowing out our best defensive talent. It's also why we see so many skilled defenders pivot to the Red Team. After all, why not make the jump? You still leverage your hard-won architecture knowledge, you get direct attribution for your wins, and you don't have to herd cats through backlog remediation in a shooting gallery that never closes.

Would I lead my children into cybersecurity? It depends:

• If their passion pulls them toward Blue Teaming, it depends on whether I can teach them to treat security as a risk trade-off, insulating them from the emotional brick wall that breaks so many defenders.
• If their ambition leans toward Red Teaming, it depends on whether they have the discipline and business acumen to prove tangible ROI on the offensive side of the ledger.

And above all, it depends on whether our industry can break its own habits before we end up bringing Skynet online just to triage our backlog.