iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
AI can make a cybersecurity team look more capable without proving that its people have become more capable. Faster triage, polished explanations and automated recommendations raise visible output, but they do not show whether an analyst can investigate an unfamiliar incident, challenge a wrong answer or make a defensible decision when the tool is unavailable. That measurement problem is the central warning in Tinus Green’s August 10, 2026 commentary, “Automation Is Hiding Cybersecurity’s Real Talent Crisis”.
What “AI hides the cybersecurity skills gap” means
The claim is not that every security practitioner is losing skills, or that using an AI assistant automatically makes someone less competent. It is that conventional productivity measures can conceal a capability gap. If an analyst closes more alerts after adopting AI, the dashboard records higher throughput. It may not record whether the analyst understood the evidence, recognized a missing signal, evaluated competing explanations or could repeat the work independently.
Green describes two very different outcomes:
- AI accelerating expertise: an experienced practitioner uses automation to search more data, test hypotheses faster and spend more time on judgment.
- AI masking a gap: a practitioner accepts a plausible answer for work they do not fully understand, so the result looks complete even though the reasoning cannot be checked or reproduced.
The distinction matters most in incident response, detection engineering, threat hunting and risk decisions where a confident mistake can delay containment or send a team after the wrong cause. The percentages discussed below describe reported attitudes and behavior; they do not, by themselves, prove that AI caused a workforce-wide decline in skill.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What the reported numbers actually say
Green’s article reports survey percentages attributed to cybersecurity workers. The linked TryHackMe report page identifies Censuswide as the research platform, but the accessible material does not provide the sample size, geography, field dates or exact wording needed to assess representativeness. Treat these as findings reported by the article, not as a universal measurement of the profession.
| Reported result | How to interpret it |
|---|---|
| 82% say AI makes them feel more productive, but not more skilled. | Many respondents distinguish speed from capability; this is a perception, not a practical skills test. |
| 38% are confident their current skills will remain valuable in the near future. | Respondents express uncertainty about which human abilities will retain value. |
| 18% expect to take on responsibilities they have not learned to handle. | Some anticipate role expansion faster than their preparation. |
| 76% regularly rely on AI for tasks they do not fully understand. | Reliance may increase the chance that an unverified explanation enters a workflow. |
| 66% say they would struggle to do their job without AI tools. | Dependence is a resilience concern, but the result does not show whether the tools are used appropriately. |
| 98% admit using AI tools their organization has not approved. | Shadow use creates governance, confidentiality and audit problems; the figure should not be generalized to every organization. |
| 18% say training resources exist but feel disconnected from daily work. | Availability of courses does not guarantee job-relevant practice. |
The TryHackMe landing page displays a separate set of results for overall workers: 62% say AI makes them more productive but not more skilled, 43% regularly use AI for work they do not fully understand, 40% would struggle to perform effectively without AI tools, and 66% say AI has made decision-making faster but not smarter. These figures come from a different population or reporting frame and must not be merged with the cybersecurity-worker percentages. The page does not show a publication date for that report. See the report landing page for the figures and its stated Censuswide provenance.
Why output metrics can conceal capability
Speed is easy to count
Security operations centers commonly track alerts handled, mean time to acknowledge and mean time to contain. AI can improve each metric by summarizing logs, proposing queries, grouping related events or drafting a ticket. Those are useful operational gains, but they measure the path to an answer, not the quality of the analyst’s mental model.
Correct-looking answers can be wrong
AI systems can produce a fluent explanation from incomplete or misleading input. An analyst who understands the underlying telemetry will ask what is missing, test an alternative cause and identify uncertainty. An analyst who does not may copy the explanation into a case record because it sounds authoritative.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Rare incidents expose the difference
Routine alerts often have familiar patterns and abundant examples for an automated system to imitate. Novel attacks, corrupted evidence, conflicting indicators and incomplete timelines require transfer of knowledge. A team that has measured only assisted routine work may discover its weakness during the one incident for which no ready-made answer exists.
Rank #2
- Matt-laminated and greaseproof pages ensure glare-free reading and long life
- The outside covers are made from a new rubberized material for better Handling and Grip
- All the Tool Holder Identification Sections now include a full INCH section along with a METRIC section
- Updated and Improved Index Searching
What leaders should measure instead
Green recommends evaluating reasoning, trade-offs and prioritized signals rather than only the final outcome or completion time. The following framework turns that recommendation into observable checks. It is a practical assessment design, not a validated scoring system.
| Capability to assess | Evidence to collect | Warning sign |
|---|---|---|
| Explainability | A written or spoken chain from evidence to conclusion, including uncertainty. | The analyst repeats the tool’s wording but cannot identify the decisive evidence. |
| Signal selection | The indicators, logs and context the analyst prioritized, with reasons. | High-volume or visually prominent signals are accepted without relevance testing. |
| Trade-off judgment | What the analyst chose not to investigate and the operational cost of that choice. | No consideration of false positives, service impact or attacker dwell time. |
| Verification | Queries, pivots, corroborating sources or reproduction steps used to test the recommendation. | The AI output is treated as evidence rather than a hypothesis. |
| Novel-scenario handling | Performance on an unfamiliar or incomplete-information exercise. | The analyst stalls when the prompt does not resemble a known playbook. |
| Independent performance | Results from a comparable exercise completed without the assistant. | Assisted speed is high while unassisted reasoning collapses. |
How to compare AI-assisted and AI-independent work
A fair comparison keeps the scenario, time limit and success criteria consistent while changing only access to the AI tool. Do not use the exercise as a gotcha or a reason to ban assistance; the purpose is to locate where automation adds leverage and where it is substituting for understanding.
- Choose a realistic scenario. Use a case involving several data sources, an ambiguous indicator and at least one plausible alternative explanation. Include the kind of incomplete information that responders face in production.
- Define the expected decision. Specify what must be decided—such as containment scope, escalation or a detection change—without prescribing the route.
- Record baseline work. Have the practitioner complete one version without AI access. Capture time, evidence cited, assumptions, uncertainty and the final recommendation.
- Run the assisted version. Permit the same approved tool and normal documentation practices. Log prompts, returned recommendations, edits and verification steps.
- Score reasoning separately from outcome. Assess whether the person found the important signals, considered alternatives, challenged the output and explained trade-offs. A fast correct answer with no defensible reasoning should not receive the same evaluation as a well-supported decision.
- Debrief the divergence. Ask what the tool changed: Did it reveal a useful path, reduce mechanical work, introduce an unchecked assumption or prevent the analyst from forming a hypothesis?
- Repeat across difficulty levels. One exercise cannot distinguish a temporary lapse from a persistent gap. Include routine, novel and deliberately ambiguous cases.
Controls for shadow AI and over-reliance
The article-reported 98% figure for use of unapproved tools points to a governance problem as much as a training problem. Prohibiting all experimentation can push use further underground; allowing unrestricted use can expose sensitive data and remove auditability. A workable program makes the safe path easier than the hidden path.
Recommended Free Tools
- Publish an approved-tool list. State which services may process company data, which data classes are prohibited and how prompts and outputs are retained.
- Provide a sanctioned test environment. Give practitioners a place to explore prompts with synthetic or redacted telemetry, along with logging and access controls.
- Require human sign-off for consequential actions. Containment, blocking, eradication and risk acceptance should identify the responsible human and the evidence reviewed.
- Keep the original evidence. Store relevant logs, queries and tool output so another responder can reproduce the reasoning instead of relying on a generated summary.
- Review failure cases without blame. Near misses reveal where the interface, policy or training encouraged acceptance of an answer that should have been challenged.
These controls do not establish that the reported survey behavior occurs in every organization. They are proportionate responses to the specific risks of unapproved processing, untraceable decisions and dependence on a single tool.
What effective training needs to practice
Green’s argument is that training should resemble the decisions practitioners make at work, not merely present disconnected lessons. A useful program combines technical investigation with judgment under uncertainty.
Investigation, not just tool operation
Learners should pivot between authentication records, endpoint events, network data and cloud activity; identify what each source can and cannot prove; and document a timeline. The objective is a defensible explanation, not simply a completed query.
Attacker behavior and competing hypotheses
Exercises should require participants to reason about objectives, persistence and lateral movement while considering benign explanations. Add misleading indicators so that “the first plausible story” is not enough.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Verification of AI output
Let learners use an assistant, then require them to test its claims against raw evidence, reproduce a query and identify assumptions. Include examples in which the generated answer is incomplete or confidently incorrect.
Rank #4
Independent decision-making
Reserve some exercises for tool-free analysis. This is not a rejection of automation; it is a resilience check that shows whether the practitioner can still form and defend a judgment when access is interrupted or the case is unfamiliar.
TryHackMe describes browser-accessible hands-on cybersecurity training, business training and an AI Security learning path at its business resources page. That is an example of a digital training format, not independent evidence that any particular course resolves the workforce problem. Organizations should evaluate relevance to their own tools, threats, data handling rules and assessment goals.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How individual practitioners can stay valuable
Automation changes which tasks consume time, but it does not remove the need to understand evidence and consequences. Practitioners can protect their own capability by adopting a deliberate workflow:
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match- Form a preliminary hypothesis before asking the assistant for one.
- Give the tool bounded, sanitized context and ask it to state assumptions and uncertainty.
- Verify important claims against primary telemetry or a second independent method.
- Write the decision in your own words, including alternatives rejected and residual risk.
- Periodically repeat representative tasks without assistance and compare the result.
- Study failure cases: false positives, missing data, misleading prompts and incorrect recommendations.
This approach makes AI a force multiplier for existing expertise rather than a replacement for the reasoning that makes security decisions trustworthy.
What the evidence does—and does not—establish
Green’s piece is a bylined commentary by Tinus Green, identified as a TryHackMe Senior Content Engineer and MWR CyberSec Head of Consultancy. Its interpretation is useful for framing a risk, but it is not a causal study showing that automation reduced skill. The accessible report page does not provide enough methodology to reconcile the cybersecurity-worker figures with the separate overall-worker results, estimate sampling error or claim representativeness.
Historical statements in the commentary about cloud adoption and employer demand should likewise be treated as Green’s framing unless supported by separate evidence. The strongest defensible conclusion is narrower: organizations that measure only AI-assisted speed may miss whether people can explain, verify and reproduce consequential security work.
A practical leadership checklist
- Can each analyst explain why a signal mattered and what evidence would change the conclusion?
- Do case records preserve assumptions, alternatives, trade-offs and verification—not just the generated summary?
- Are assisted and unassisted exercises compared on the same scenarios?
- Are novel, incomplete-information incidents part of skills assessment?
- Does training use the organization’s real tools, threats and escalation decisions?
- Is there an approved way to use AI with sensitive data, with logging and accountability?
- Are careful checks rewarded alongside rapid closure?
If the answer to these questions is no, a productivity dashboard may be telling only half the story.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
