For years, cybersecurity was often viewed primarily as an IT responsibility.
Technology teams implemented firewalls, managed access, monitored threats, and responded when something went wrong. Employees might complete annual security awareness training, but the responsibility for keeping the organization secure largely sat somewhere inside the technology function.
That approach is becoming increasingly difficult to sustain.
In a recent episode of Certifying the Future, host Scott D’Amico spoke with cybersecurity and workforce development leader Maurice Gibson about why cybersecurity has to become something much broader: part of the culture of the organization itself.
The reason is simple. Security decisions are no longer confined to the IT department. They happen every day across the business.
Employees choose which tools to use. Teams look for shortcuts when technology gets in the way of getting work done. Leaders decide how quickly new systems are deployed. Organizations introduce artificial intelligence into workflows, often faster than policies and governance can keep pace.
Every one of those decisions can create either greater resilience or greater risk.
Cybersecurity Is More Than a Training Problem
Employee training remains important, but training alone cannot create a secure organization.
An employee can understand security best practices and still make risky choices if the approved tools prevent them from doing their job effectively.
Maybe the company-issued phone does not allow access to something they need, so they use a personal device instead. Maybe the approved process takes too long, so a team adopts an unsanctioned application. Maybe employees begin putting company information into an AI tool because no one has provided an approved alternative.
Those behaviors are often described as employee security problems.
But they may actually point to something bigger.
If employees consistently have to work around security controls to accomplish legitimate business objectives, the issue is not simply whether they completed enough cybersecurity training. It may indicate that security, technology, and the business are not sufficiently aligned.
That is why cybersecurity needs to be part of the organizational culture.
A culture of security asks more than, “Did we train our employees?”
- Do employees understand why security matters?
- Are security policies realistic for the way people actually work?
- Are business and technology leaders communicating?
- Is security considered when new initiatives are being designed?
- Do employees know which tools and behaviors are acceptable?
- Does leadership reinforce security through actions as well as words?
Cybersecurity Is the Seatbelt, Not the Car
One of the most memorable analogies from the conversation was Maurice’s description of cybersecurity:
Cybersecurity is not the car. It is the seatbelt.
The organization is going somewhere.
It has customers to serve, products to develop, employees to support, revenue to generate, and new technology to adopt. Cybersecurity is not supposed to prevent the organization from moving forward.
Its role is to help the organization move forward safely.
That distinction matters because security can sometimes be perceived as the department that says “no.”
If security is introduced only after a technology implementation or business decision has already been made, controls can feel like obstacles added onto the strategy.
A better model is to involve security from the beginning.
Security leaders should understand where the organization wants to go, how the business needs to operate, and what risks need to be managed along the way.
The goal is for security to fit into the strategy, rather than having to be fitted onto the strategy afterward.
Security Leadership Needs a Seat at the Table
Creating that alignment requires security leadership to participate in broader business conversations.
It is not enough for security responsibility to simply become an additional duty assigned to a technology executive.
Organizations increasingly need leaders whose primary responsibility is understanding risk, security, and governance and who can work alongside technology, operations, finance, human resources, and other business functions.
That participation needs to happen early.
When security is considered only after a system has been implemented, the organization may spend more money correcting vulnerabilities, redesigning workflows, or applying controls that should have been considered during the initial planning process.
In contrast, bringing security into strategic conversations allows organizations to ask important questions before implementation:
- What are we trying to accomplish?
- What data or systems will be involved?
- Who needs access?
- What risks are created?
- What safeguards should be built into the process?
- How can we protect the organization without preventing people from doing their jobs?
This is also where culture starts at the top.
When security is visible in executive decision-making, employees receive a very different message than when it is treated as an occasional compliance activity.
AI Makes the Culture Question Even More Important
Artificial intelligence is accelerating many of these challenges.
Organizations want employees to use AI because of the potential productivity and efficiency gains.
At the same time, unrestricted AI usage can create new questions around sensitive information, data access, intellectual property, security, governance, and accountability.
Simply telling employees, “We don’t use AI,” is increasingly unrealistic.
Employees are already encountering these tools inside applications they use every day, and many will look for ways to use them to work more efficiently.
The challenge for organizations is therefore not whether to acknowledge AI.
It is how to enable people to use AI effectively and safely.
That requires clear guardrails around issues such as:
- what information employees can enter into AI systems
- which AI tools are approved
- what systems AI applications can access
- how AI-generated information should be reviewed
- who remains accountable for decisions
- how access and privileges are managed
Many traditional cybersecurity principles still apply.
Organizations already think carefully about what employees can access, how privileges are assigned, and how sensitive systems are protected. Similar thinking needs to be applied to AI systems and agents.
AI does not eliminate the need for security culture.
It increases it.
Credentials Still Matter, but Employers Need Clarity
The conversation also explored the relationship between cybersecurity careers, credentials, and workforce readiness.
Certifications and badges continue to serve an important purpose because employers need ways to evaluate large pools of candidates.
A certification can provide a signal that a candidate has invested in developing a particular body of knowledge or capability.
But employers also need to understand what different credentials actually represent.
One example raised during the conversation was the disconnect that can occur when an employer advertises an entry-level role while requiring a certification designed for a much more experienced professional.
Those two things do not necessarily align.
For employers, that means becoming more thoughtful about defining the skills and credentials genuinely required for a role.
For professionals, it means avoiding the temptation to pursue every certification available.
A stronger approach is to develop a specialization and choose credentials that support the type of work you want to perform.
Certifications can help get someone into the conversation.
What happens next still depends on the person’s ability to demonstrate experience, critical thinking, collaboration, communication, and the ability to apply what they know.
Human Skills May Become Even More Important
That last point becomes particularly important as AI takes on more tasks.
Professionals are unlikely to create long-term career value by trying to outperform machines at the things machines do best.
Instead, they need to understand where AI exists within a workflow and identify where human capability still creates value.
AI may analyze information, generate content, automate processes, or identify patterns.
Humans still need to decide what information goes into those systems, evaluate what comes out, understand context, exercise judgment, collaborate with others, and take responsibility for decisions.
The future of workforce readiness is therefore not simply about acquiring more technical skills.
It is about combining technical capability with distinctly human strengths such as:
- critical thinking
- communication
- collaboration
- judgment
- leadership
- problem-solving
- adaptability
Those capabilities are especially important in cybersecurity, where technology, people, business priorities, and risk constantly intersect.
Building a Culture of Security
The most resilient organizations will not treat cybersecurity as something owned exclusively by IT.
They will build it into how the organization operates.
That means training employees, but it also means giving them tools that support secure behavior.
It means implementing technology, but also understanding how that technology affects business workflows.
It means creating policies, but also making sure those policies reflect how people actually work.
And it means involving security leaders before important decisions are made, not after systems have already been deployed.
Cybersecurity may be the seatbelt rather than the car.
But if organizations want to continue moving quickly in an environment shaped by AI, automation, and constant technological change, making sure everyone is wearing that seatbelt has never been more important.
Listen to the Conversation
Hear the full conversation with Maurice Gibson on Certifying the Future, a podcast from CertNexus exploring how emerging technology is reshaping skills, credentials, and workforce readiness.