Every issue of Becoming Cyber this fall has turned on one question: if software takes over the entry-level work that today’s experienced security practitioners learned on, where will the next ones come from? On 23 September, on The Ezra Klein Show, Ezra Klein put his own version of it to Jensen Huang, who runs Nvidia. Klein noted that software engineering postings are up but more senior, a pressure he sees in his own industry too, before asking it outright: “So do you need the same junior employees, or do you need more people to oversee their agents?” Huang replied, “Oh, good one. Wait two years.” He reasoned that it takes four years to go to college and the first students who learned alongside this technology are about two years from graduating, which Klein summed up as a generation native to the tools, and Huang agreed.
The part of the problem Huang’s answer covers is real: a degree can make someone fluent with the tools, and fluency is worth having on any team I would want to lead. Klein’s question was about the people who start at the entry level, though, and Huang’s answer was about where fluent ones come from. Fluency can arrive with schooling, while the judgment that experienced practitioners are paid for has arrived later, on the job, from real cases. As I read it, the answer explains where fluency will come from and leaves out where judgment will come from, and judgment is the thing security has never had to produce on purpose.
When the Job Is the Task
Later in the same conversation, Huang drew a distinction I agree with completely. “For everybody’s job,” he said, “there’s the purpose of the job and then there’s the task you do as the job.” His example was radiology: if software studies the scans, the radiologist’s purpose, which is to diagnose disease, stays the same. Becoming Cyber has held since its first issue that the work at the entry level is being hollowed, not eliminated. It is useful to hear the same idea from one of the most optimistic voices in the industry.
Huang was candid that the distinction breaks down in some work: “Some jobs, where the job and the task is really one, like customer service on the phone, in a lot of cases, that job is precisely the task. In those cases, it could be automated away.” In security, the job and the task sit closest together at the entry level, where a new practitioner’s first year is mostly the task itself: working the case, checking the evidence, and writing it up. The seat can survive that, as the compliance case in the last issue showed, while the work that filled its first year moves to software.
The Sentence I Got Half Right
In We Are Automating the Job That Made Us, I described my own start this way: “The seat I landed in taught me the trade. Somebody two chairs over answered my questions for a year.” I called that the mechanism, and I had the right paragraph with the wrong sentence carrying it. The second sentence is the mechanism. The seat supplied the cases, a steady stream of real ones, and the person two chairs over supplied the teaching, by looking at what I had looked at and telling me what I had missed. Credit belongs to that person, and to the people like them in every team I have worked on.
The first sentence is the one most of us believe, and I understand why. In the same issue I suggested asking anyone with fifteen years in security where they learned to read a log properly, and I said they would describe a chair, a queue of alerts, and a person nearby. Most people I know would tell it that way, and I told it that way myself. Those accounts come from people who made it, and someone who made it cannot easily tell whether the volume of work taught them or is simply the part they remember most. The people who sat in the same seat without learning the trade are rarely the ones anyone asks. That is why this issue refines the analysis and gives the credit to the person two chairs over.
Two People, One Real Case
The work a new practitioner sees is mostly routine, and the cases that matter are rare. A 2024 study presented at USENIX Security examined the alerts at one academic supercomputing center and found that, of the 14.4 million alerts it categorized over twenty months, 1,114 were tied to real attacks, and those 1,114 alerts traced back to eleven attacks in all. Those figures come from a single research network and from one slice of a much larger dataset. The pattern holds in the environments I have worked in, where anyone handling that volume sees a great many false alarms and very few real attacks.
What a new practitioner learned about the rare case, then, came mostly from someone who had already seen one, and organizational researchers described why more than thirty years ago. In a 1991 paper on how organizations learn from rare events, James March, Lee Sproull, and Michal Tamuz wrote that “greater reduction in uncertainty can often be achieved by pooling observers than by pooling events.” In this field, two people looking at one real case can learn more from it than one person looking at a thousand routine ones, because each sees something the other missed and they have to reconcile it out loud. That kind of moment is an occasion for learning: a new practitioner and an experienced one working the same real case, with something at stake, before either of them knew the answer. The work supplied the occasion, and the person supplied the teaching.
The work supplied the occasion, and the person supplied the teaching.
The Pipeline Paradox
Every experienced practitioner I know can name at least one person who looked at a real case with them early on, and most can name several. Every case an agent resolves still needs an experienced practitioner to stand behind the verdict, so automation makes those practitioners more necessary. The same automation thins out the occasions for learning that produced them, because more cases are resolved by software before a new practitioner and an experienced one can work them together. That is the pipeline paradox. It does not show up in headcount, because the seat can stay while those occasions thin out. Productivity figures miss it too, because nobody ever counted them.
This wave of automation takes the first look at each case it reaches, before any person sees it. When an agent works a case first, the raw case that two people used to stand over arrives as a verdict with a summary attached. The experienced practitioner can still review the verdict, and the new practitioner can still read the summary. What has gone is the moment when both of them looked at the same unresolved case. That moment was the occasion for learning. It was never on anyone’s task list, so it left with the tasks without anyone deciding it should.
It was never on anyone’s task list, so it left with the tasks without anyone deciding it should.
Who Pays for the Teaching
Teaching also has a price, and a study from outside security has measured it. A working paper by Natalia Emanuel, Emma Harrington, and Amanda Pallais followed 1,055 software engineers on 304 teams at a Fortune 500 online retailer from 2019 to 2024. The researchers tracked two things: how much finished work each engineer turned in, and how much written feedback newer engineers received from colleagues on the work they submitted.
Before the pandemic, while the offices were open, experienced engineers who sat in the same building as their teammates turned in less finished work than experienced engineers whose teams were spread across different offices, a little under one fewer piece of work a month. When COVID-19 closed the offices in 2020 and everyone worked from home, most of that gap disappeared, because the experienced engineers who used to sit with their team suddenly had the time back. The newer engineers on those teams lost what that time had been buying, about two fewer pieces of written feedback on each piece of work they submitted, compared with newer engineers whose teams had always been spread out. In plain terms, sitting near newer colleagues cost experienced engineers some of their own output, and that output had been paying for the newer engineers’ learning. It is one company and one profession, and the paper has not yet been through journal review, so it shows the direction of the effect more reliably than its exact size.
Because an occasion for learning costs the experienced practitioner real output, teaching is the easiest line for any efficiency program to remove and the hardest for anyone to notice. The saving shows up in the experienced practitioner’s own results, and the loss shows up years later in someone else’s. None of this requires a villain. Each decision to automate a case is defensible on its own terms, and no budget ever counted the teaching that happened while two people worked that case. That is why someone now has to account for it on purpose.
The Transistor Thinker
Huang made the strongest version of the optimist’s case near the end of the conversation, with an example from chip design, where a transistor is a tiny electronic switch and a chip is built from enormous numbers of them. “Today’s engineers are far better systems thinkers than I was when I graduated from school,” he said. “But I was a much better transistor thinker.” The first chip he worked on had 200 transistors, few enough that he knew every one of them by name, while today’s chips hold billions and engineers build them by combining large, ready-made components without ever looking at the individual switches inside. He accepted the trade plainly: “So some of the lower-level knowledge is gone.” Working at a higher level is real progress, since no one could design a chip with billions of switches one switch at a time.
Huang still became a systems thinker only after years as a transistor thinker, learning the switches before he learned to work above them. Security has its own version of the switches: the networks, computers, and user accounts underneath the tools that summarize them on a screen. Incidents happen down there, and the experienced practitioner is the person who knows what those systems look like when something has gone wrong. Klein made the same point from the other side earlier in the conversation: “It can’t be the case that everything can be traded off.” Some of the entry-level toil can go, and much of it should. The occasion for learning has to be kept on purpose, because until now it came bundled with the toil and no one had to choose it.
Why the Bill Arrives Late
The cost of the pipeline paradox arrives years after the decision that causes it, because judgment takes years to form. That is the reply to “wait two years.” Two years is long enough to produce fluency with the tools and short of the time it takes to make an experienced practitioner. The cost also lands on many organizations at once, because so much of the field is automating the same entry-level work. So a team that later needs experienced practitioners would be trying to hire them from neighbors who skipped the same occasions for learning. Once the shortfall is visible, money cannot close it quickly, because the only known way to make an experienced practitioner is the slow way, one real case at a time with someone beside you. A cost that arrives late, lands everywhere at once, and cannot be bought quickly rarely makes it into anyone’s plan.
A cost that arrives late, lands everywhere at once, and cannot be bought quickly rarely makes it into anyone’s plan.
The Next Step
If you are trying to get in, earlier issues gave you two questions to ask: who will teach you, and how a new person on the team first sees a real case. Once you have those answers and more than one offer, weigh the person you will work real cases beside more heavily than the tools or the title. The tools are spreading to every team, so the occasion for learning is the scarcer part of any first job. A team where an experienced practitioner still sits down with new people on real cases is offering the thing a degree has never supplied in this field.
If you are an experienced practitioner or you lead a team, start by counting the hours in the last month that someone experienced spent working a real case with someone new. If nobody can produce that count, then nobody owns the teaching. Teaching time costs experienced people some of their own output, as the study above showed, so it is the easiest line to remove unless someone decides to protect it. Bring the count to your next planning meeting and ask whether this team can still make an experienced practitioner five years from now.
Somebody two chairs over taught me the trade while we were both looking at a real case. Software is now taking the first look at cases like that one, and the field has to decide on purpose where the next generation will get its occasions for learning.
— Oritse
A note on where I stand: I spent years running security inside large financial institutions, and I sit on the advisory board of a company building autonomous security tools, which is the category whose work this issue describes. Nothing non-public, from anywhere I have worked, goes into what I write here.
Next: which skills get more valuable when software takes the first look.