Why CISOs Should Fund Degrees Before Buying Another Security Tool
Every budget cycle, security leaders face some version of the same choice. One option adds another platform to an already crowded security stack. The other invests in the people who have to operate that stack, whether through tuition assistance, professional development, or degree sponsorship.
The platform often has an easier case to make. It comes with a demo, a feature list, and a clear price. Education has a longer horizon, and its value is harder to fit into a procurement spreadsheet. However, adding another tool doesn’t necessarily solve a capability problem.
A platform can identify an exposure, generate an alert, or automate part of a workflow. Someone still has to understand what happened, determine which systems and data are involved, assess the severity of the risk, and know what to do next. If nobody on the team has that expertise, another dashboard may simply create another queue of alerts.
The Security Gap Isn’t Just About Headcount
Cybersecurity has spent years talking about a worker shortage. For individual security teams, however, the more useful question isn’t always how many people are missing. It’s what the people already there don’t know how to do yet. That distinction has become more important as security responsibilities expand.
Cloud infrastructure, application security, AI governance, privacy, identity management, and data security increasingly overlap. A capable analyst may understand endpoint security extremely well and still have little experience evaluating how an AI application retrieves internal data. A cloud engineer may understand permissions without knowing how privacy requirements affect the information an AI system should be allowed to access. Hiring a new specialist for every emerging area isn’t realistic for most organizations.
Certifications can help employees build narrower technical competencies, and CyberDB’s overview of cybersecurity certifications used in tech hiring shows just how many paths now exist. But some capability gaps require something broader: enough grounding in systems, networks, data, governance, and risk to understand how the pieces interact.
That makes developing existing employees a security strategy, not simply an HR benefit.
Why AI Security Is a People Problem First
AI makes the distinction particularly obvious. Security vendors have responded to enterprise AI adoption with posture-management tools, prompt filters, monitoring platforms, access controls, and other products designed to identify or contain new risks. Many of those tools have legitimate uses. The harder problems often begin before the security product enters the picture.
Consider an enterprise retrieval system that gives an AI assistant access to internal documents. If the organization hasn’t properly classified its data or carried the original access permissions into the retrieval environment, the model may surface information to someone who shouldn’t see it. That’s fundamentally a data-governance problem.
Assessing data readiness for AI means understanding issues such as permissions, classification, ownership, and quality, as well as how information moves between systems, before connecting it to an AI application. A security tool may help detect problems later, but it can’t make those foundational decisions for the organization.
The same pattern appears in many overlooked data leak points in modern applications. Information doesn’t always leak because an attacker broke through a perimeter. Sometimes an application exposes data because it was technically allowed to retrieve it and nobody adequately considered what should happen next.
That requires people who understand both the technology and the governance around it.
Tuition Can Build Skills You Can’t Easily Hire For
The strongest argument for education isn’t that every employee needs another credential. It’s that organizations already have people who understand their environment.
An internal analyst knows which systems are difficult to maintain. An engineer knows where permissions have accumulated over time. A security manager knows which policies look good on paper but fall apart during an incident. Replacing that institutional knowledge with an outside hire has its own cost.
Tuition assistance gives organizations another option: identify employees who already understand the environment and help them build the capabilities the team is missing.
That could mean cloud security architecture for an analyst moving toward engineering, governance and risk education for someone taking responsibility for AI oversight, or a broader cybersecurity degree for an employee who has accumulated technical experience without the underlying academic foundation. It also doesn’t have to mean sending someone away to school for several years.
For working professionals, online programs can make it possible to continue working while studying, but the structure varies considerably between schools. When comparing online colleges, factors such as transfer-credit policies, course length, start dates, tuition, and whether students take several courses simultaneously can matter as much as the degree title itself.
For a security analyst participating in an on-call rotation, those details aren’t minor conveniences. They can determine whether the employee can realistically finish the program while continuing to do the job the company is paying them to do.
Turn Coursework Into Security Work
A degree becomes considerably easier to defend in a security budget when the learning doesn’t stay in the classroom. Employees can apply coursework to problems the organization already needs to solve.
Someone studying access-control models can review permissions in an internal application. A cloud security course can inform a review of an existing deployment. Database and data-engineering coursework can help an employee map how sensitive information moves between systems. A class on risk frameworks can serve as a starting point for evaluating an AI project another department wants to launch.
The goal isn’t to turn every assignment into unpaid company work. It’s to create opportunities for employees to connect what they’re learning with systems they already understand. That also gives managers a way to evaluate the investment before graduation.
Instead of waiting several years and asking whether the degree “worked,” they can look for smaller changes: better documentation, stronger architecture reviews, more thoughtful risk assessments, employees taking ownership of increasingly complex projects, or less reliance on outside expertise.
Choose Education Around the Gaps You Actually Have
Tuition assistance works best when it isn’t treated as an unlimited menu. Start with the team’s capability map. If AI projects are expanding, the organization may need stronger knowledge of data governance, identity and access management, cloud architecture, privacy, and AI risk. If application security is the weakness, secure development and software architecture may matter more. A company moving heavily into the cloud will have a different educational priority than one trying to formalize GRC. Then evaluate programs against those needs.
For cybersecurity roles, useful coursework may include networking, cloud architecture, identity and access management, database systems, data classification, privacy, secure software development, incident response, and risk frameworks. AI-focused teams should also look for coursework that addresses how data is collected, stored, accessed, and governed rather than choosing a program simply because “AI” appears in its marketing.
Program structure matters, too. Transfer policies, asynchronous coursework, predictable tuition, frequent start dates, and manageable course loads can make a major difference for employees balancing school with incident response, audits, and on-call responsibilities.
The best program isn’t necessarily the one with the longest list of cybersecurity courses. It’s the one that develops a capability the organization needs and that the employee can realistically complete.
Don’t Treat Tools and Training as Opposites
None of this means CISOs should stop buying security technology. Modern environments require tooling. Organizations need visibility, automation, monitoring, access controls, vulnerability management, and dozens of other technical capabilities that people cannot reproduce manually at scale. The problem is assuming the purchase completes the job.
Every security platform embeds assumptions about the people operating it. Someone has to configure it correctly, interpret what it finds, connect its output to the rest of the environment, recognize when it’s wrong, and make decisions the software cannot make on its own.
As the stack becomes more sophisticated, the expertise required to operate it grows.
Build the Team Alongside the Stack
The next security budget doesn’t have to come down to education or technology. In most organizations, it should include both.
But when a team already has plenty of tools and still struggles with AI governance, cloud architecture, data security, or another persistent capability gap, another platform may not be the missing piece.
Start with the gap. Determine whether technology can actually solve it or whether the organization needs someone who understands the problem more deeply. If it’s the latter, investing in an employee who already knows the environment can build capability that stays useful long after the next software contract expires.
Security tools will keep changing. The people responsible for deciding how to use them are the part of the stack worth developing, too.
