An editorial piece by Jaded Security on certification worship in the security industry and the gap between credential and competence.

This is going to annoy a lot of people in this industry: having a certification does not make someone a security professional. It makes them a person who passed a test.

Before the pitchforks come out — this is not an anti-certification argument. Certifications have their place. This is an anti-certification-worship argument.

The hiring problem

Every security job posting requires a CISSP, a CISM, or both. Some want all of those plus a GIAC certification or two. HR departments have turned certifications into a filter, and in doing so, they have created an industry where passing tests matters more than actual competence.

Hiring managers in the industry routinely see candidates with impressive certification portfolios who cannot explain how a SYN flood works. They also see people with no certifications who can reverse-engineer malware before lunch and write detection rules before dinner.

The certification proves a candidate can study. It does not prove they can think.

What actually matters

Curiosity. The best security people in the industry are the ones who take things apart to understand how they work. They read source code for fun. They set up labs and break their own systems. They follow vulnerability disclosures not because it is their job, but because they genuinely want to understand the flaw.

Curiosity cannot be certified. It cannot be tested for on a multiple-choice exam. But it is the single most important quality in a security professional.

The balanced view

Certifications have value. They provide a common vocabulary. They force candidates to study domains they might otherwise ignore. They open doors with HR departments that use them as filters.

But they are the beginning of an education, not the end. The moment a holder starts treating the certification as proof that they know enough is the moment they start falling behind.