Free tools Windows power users keep installed
One-click scans. No signup required.
How do you move from computers and IT into cybersecurity—and eventually AI security? Treat it as a progression of skills and work, not a single required career ladder. IT experience can give you useful starting points; the next step is to identify the security work you want to do, fill its specific skill gaps, and then add knowledge of AI systems and their risks.
Start by identifying what your IT experience gives you
“Computers and IT” can mean very different work. One person may have spent years troubleshooting devices; another may work with networks, software, identity, data, or operations. Take inventory of what you have actually done rather than assuming every IT background includes the same capabilities.
As an Amazon Associate I earn from qualifying purchases.
- Systems and devices you have configured, maintained, or troubleshot.
- Networks, applications, or infrastructure you have supported.
- How you have handled accounts, permissions, data, and access problems.
- Operational work such as monitoring, documentation, incident response, or service continuity.
- Security-related problems you have encountered, and what you did to understand or resolve them.
This inventory helps you connect prior experience to a target role and spot what you still need to learn. It is a reflection exercise, not a claim that all IT jobs provide the same preparation.
Choose a cybersecurity direction by looking at the work
Cybersecurity is a collection of work roles, not one job with one universal set of duties. NIST’s NICE Framework describes work through roles and associated tasks, knowledge, and skills; it does not prescribe a career ladder or make work roles interchangeable with job titles. Use those descriptions to explore the work itself, then compare them with the roles employers use in your area. NIST’s NICE Framework publication dates to November 16, 2020, and its page directs readers to current framework components.
#1 Best Overall
For example, you might be drawn to protecting systems, investigating suspicious activity, assessing risk, or building secure software. These are different kinds of work. A useful target is specific enough to guide learning: identify the tasks you want to perform, the skills those tasks call for, and the experience you already have that is relevant.
Use career pathways as a map, not a fixed sequence
There is no single credential order or educational route everyone must follow. NIST describes cybersecurity pathways that can combine education, experience, training, and certifications in different ways. Its Cybersecurity Career Pathway Resources include options such as CompTIA Security+ and SANS training; they are examples to consider, not universal requirements or endorsements.
CISA’s Career Pathways Roadmap can help compare work roles, shared skillsets, mobility, and stepping-stone roles. Last published July 29, 2025, it identifies NICE Framework Components version 2.0.0 as its data source. Use it to explore possible connections between roles, not as a promise that a particular move will be available or automatic.
Compare routes against your target role
- Day-to-day work: Which tasks would you actually like to do?
- Skill overlap: What relevant abilities do you already use in your current work?
- Gaps: Which knowledge or skills do the target role’s tasks require that you have not yet developed?
- Learning fit: Which format—formal education, guided training, self-study, or hands-on practice—works for your circumstances?
- Credential relevance: Does the target role or employer request a particular certification, or is it simply one possible way to learn?
Time and cost depend on the learning option and your circumstances, so compare actual current offerings rather than assuming one route is faster or cheaper for everyone.
Rank #3
Build AI security on top of core cybersecurity
Moving toward AI security does not mean leaving foundational security behind. NIST identifies overlapping concerns between AI system security and broader cybersecurity, including confidentiality, integrity, availability, data, and the software and hardware on which systems rely. That means experience securing infrastructure, managing access, protecting data, or evaluating system behavior can provide a useful base, depending on what your role has involved. See NIST’s AI security and resilience research overview.
Then add the AI-specific questions: what risks arise from the system’s design and development, how it is deployed and used, what data and dependencies it relies on, and how its behavior and safeguards are evaluated. AI security work can involve understanding the system across its lifecycle, rather than treating a model as an isolated piece of software.
Use NIST AI guidance with its status in mind
- NIST’s AI Risk Management Framework (AI RMF) 1.0 was released January 26, 2023. It is intended for voluntary use, and NIST says the framework is being revised.
- The NIST Generative AI Profile, published July 26, 2024 and updated April 8, 2026, is a cross-sector companion offering suggested actions for managing generative AI risks.
- NIST’s Cybersecurity Framework Profile for Artificial Intelligence (Cyber AI Profile) is an initial preliminary draft, published December 16, 2025—not a final standard. Its page notes that the public comment period is closed and references 2026 virtual working sessions.
Because this guidance is changing, check the relevant NIST page when relying on a framework or describing its status. Distinguish published guidance from a preliminary draft, and do not treat voluntary guidance as a mandatory certification or prescribed career route.
Turn the progression into a practical learning plan
- Write down your experience. List concrete systems, tasks, tools, and problems you have worked with. Note where you made decisions about access, data, reliability, or risk.
- Select a work direction to investigate. Explore NICE work roles and their task, knowledge, and skill statements. Use the NICCS roadmap to identify related roles and possible stepping stones.
- Find the gaps for that direction. Compare role tasks with your inventory. Pick a small number of missing skills to develop rather than trying to learn every area of cybersecurity at once.
- Choose learning that addresses those gaps. Consider education, training, practice, or a certification based on the target work and what employers request. NIST’s pathway resources offer examples, but no credential sequence applies to everyone.
- Add AI security deliberately. Once you have a grounding in the security concerns relevant to your path, study how they apply to AI system software, hardware, data, operation, and lifecycle risk. Use NIST’s AI RMF and related profiles as guidance, while verifying their current status.
The route from IT to cybersecurity and then toward AI security is therefore best planned as a series of informed choices: understand the work, build the skills it calls for, and extend that foundation to AI-specific risks. Your next step depends on the experience you already have and the role you want to pursue.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
