Quick Answer: What Is Cyber Security?
Cyber security is the practice of protecting systems, networks, devices, and data from digital attacks, unauthorized access, theft, and damage. It combines people, processes, and technology to preserve the confidentiality, integrity, and availability of information (the CIA triad). In 2026, cyber security addresses threats including ransomware, phishing, supply chain attacks, AI-augmented attacks, and cloud misconfiguration, and uses frameworks such as NIST CSF 2.0, ISO 27001:2022, SOC 2, and MITRE ATT&CK. US salary bands for cyber security roles in 2026 range from $55-75K at entry-level SOC analyst to $250K-$1M+ at CISO level.
Definition and Scope
Cyber security (also written cybersecurity) refers to the body of technologies, processes, practices, and personnel designed to protect networks, computers, programs, devices, and data from attack, damage, or unauthorized access. The discipline has three primary objectives that map to the CIA triad:
- Confidentiality - keeping data private from unauthorized parties through encryption, access controls, classification, and data loss prevention.
- Integrity - keeping data accurate and unaltered through hashing, digital signatures, audit logs, and change management controls.
- Availability - keeping systems and data accessible when needed through redundancy, DDoS protection, disaster recovery, and backup strategies.
Cyber security is a subset of the broader field of information security, which also covers physical and analog information assets (paper documents, verbal conversations, intellectual property). For the related discussion of information security, see our What Is Information Security guide.
Main Types of Cyber Security
Modern cyber security is organized into roughly nine branches, each with its own tools, certifications, and career paths.
Network Security
Protecting networks from intruders and misuse. Core technologies include next-generation firewalls (Palo Alto Networks, Fortinet, Cisco, Check Point), intrusion detection and prevention systems (IDS/IPS), network segmentation, virtual private networks (VPN), zero-trust network access (ZTNA), and software-defined networking (SD-WAN). Network security teams design and operate the perimeter and internal network controls.
Application Security (AppSec)
Building and testing software to be secure by design. Core technologies include static application security testing (SAST), dynamic application security testing (DAST), software composition analysis (SCA), interactive application security testing (IAST), runtime application self-protection (RASP), and the OWASP Top 10 as the foundational reference. AppSec teams integrate security into the SDLC, run code reviews, threat models, and penetration tests.
Cloud Security
Securing workloads in AWS, Azure, GCP, and other cloud platforms. Core technologies include cloud security posture management (CSPM - Wiz, Prisma Cloud, Lacework, Defender for Cloud), cloud workload protection (CWPP), cloud infrastructure entitlement management (CIEM), secrets management (HashiCorp Vault, AWS Secrets Manager), and cloud-native application protection (CNAPP). Cloud security teams handle misconfigurations, identity and access in the cloud, and incident response in cloud environments. For a deeper dive, see our What Is Cloud Computing guide.
Endpoint Security
Protecting laptops, desktops, servers, mobile devices, and IoT endpoints. Core technologies include endpoint detection and response (EDR - CrowdStrike Falcon, SentinelOne, Microsoft Defender for Endpoint, Trend Micro, Sophos), extended detection and response (XDR), mobile device management (MDM - Microsoft Intune, Jamf, VMware Workspace ONE), and anti-malware. Endpoint security teams operate the EDR platform, investigate alerts, and respond to endpoint incidents.
Identity Security (IAM)
Managing who has access to what. Core technologies include identity providers (Okta, Microsoft Entra ID, Google Workspace Identity, Ping Identity), single sign-on (SSO), multi-factor authentication (MFA), privileged access management (PAM - CyberArk, BeyondTrust, Delinea), conditional access policies, identity governance and administration (IGA - SailPoint, Saviynt), and just-in-time access. Identity security teams are increasingly central because most modern attacks involve credential abuse and lateral movement via identity.
Data Security
Protecting data at rest, in transit, and in use. Core technologies include encryption (AES-256 for data at rest, TLS 1.3 for data in transit, confidential computing for data in use), data classification, data loss prevention (DLP), key management (HashiCorp Vault, AWS KMS, Azure Key Vault), and database activity monitoring. Data security teams define classification policies, deploy DLP controls, and respond to data exposure incidents.
Operational Security (SOC and Incident Response)
The day-to-day operation of security operations centers (SOCs) and incident response. Core technologies include SIEM (security information and event management - Microsoft Sentinel, Splunk, Google Chronicle, Elastic Security, IBM QRadar), SOAR (security orchestration, automation, and response - Palo Alto XSOAR, Splunk SOAR, Tines), threat intelligence platforms (Recorded Future, ThreatConnect, Mandiant), and case management systems. SOC analysts triage alerts, investigate incidents, escalate to incident response, and run threat hunting.
OT/IoT Security
Securing operational technology (industrial control systems, SCADA, PLCs) and IoT devices. Core frameworks include NIST SP 800-82 (Guide to Industrial Control Systems Security), IEC 62443 (industrial automation and control systems security), and CISA's Cross-Sector Industrial Control Systems guidance. OT security teams work closely with engineering and operations to secure manufacturing, energy, water, and transportation systems. Salary bands are higher than corporate IT security because of the specialized skills required.
GRC (Governance, Risk, Compliance)
The strategic and policy layer that ties all technical controls to business risk and regulatory requirements. Core frameworks include NIST CSF 2.0, ISO 27001, SOC 2, PCI DSS, HIPAA, GDPR, and sector-specific regulations (financial services, healthcare, government). GRC teams run risk assessments, manage audits, write policies, and communicate security posture to executives and boards. For a structured entry path into GRC, the TutorsBot Governance, Risk and Compliance training covers audit frameworks, regulatory requirements, and risk assessment that map directly to these roles.
Top Threats in 2026
Ransomware
Ransomware remains the largest single financial-impact threat category. The 2024 Change Healthcare breach (affecting 192.7 million Americans, the largest healthcare breach in US history) cost UnitedHealth Group over $3 billion in remediation, notification, and class-action settlement. Modern ransomware operations use double and triple extortion (encrypt files, exfiltrate data, threaten DDoS or regulator notification), affiliate models (RaaS - ransomware as a service), and supply chain initial access (compromising managed service providers, software vendors, and IT service companies). Major ransomware families tracked in 2026 include LockBit successors (BlackCat/ALPHV, Akira, Play, Rhysida, Inc Ransom), Russian-aligned groups targeting Western infrastructure, and Iranian-aligned groups targeting Israeli and US sectors.
Phishing and Business Email Compromise (BEC)
Phishing is the highest-volume threat category by a wide margin. The FBI IC3 reports BEC losses exceeding $2.9 billion annually in the US alone. AI-generated phishing (using large language models to craft personalized, contextually accurate emails in any language) and deepfake voice/video phishing have become routine. Common attack patterns: invoice fraud (impersonating a CEO approving a wire transfer), payroll diversion (impersonating HR directing an employee to update direct deposit), vendor email compromise (impersonating a known supplier with a new bank account), and gift card scams (impersonating a manager asking for gift cards). Defenses: DMARC, DKIM, SPF email authentication, advanced email security gateways (Proofpoint, Mimecast, Microsoft Defender for Office 365), security awareness training with simulated phishing, and strict payment verification procedures out-of-band.
Supply Chain Attacks
Supply chain attacks compromise a trusted vendor, software dependency, or managed service provider to reach thousands of downstream customers. The 2020 SolarWinds Orion compromise (Russian SVR, ~18,000 customers affected including US Treasury, DHS, Microsoft, FireEye) and the 2024 xz-utils backdoor (caught before widespread exploitation but demonstrating the technique maturity) remain the reference cases. Current supply chain risk vectors: open-source package compromises (npm, PyPI, RubyGems), managed service provider breaches (the 2024 Snowflake customer breach wave targeting AT&T, Ticketmaster, Santander, Advance Auto Parts), software update infrastructure attacks (3CXDesktopClient, ASUS Live Update), and CI/CD pipeline compromises (CircleCI, Travis CI tokens, GitHub Actions). Defenses: SBOM (software bill of materials), SLSA framework, vendor risk management, principle of least privilege on vendor access, and zero-trust architecture.
AI-Augmented Attacks
AI is now a routine part of the attacker's toolkit. Generative AI produces convincing phishing emails that pass language and grammar checks; AI-powered voice cloning (using as little as 3 seconds of audio) enables real-time vishing attacks (the 2024 Hong Kong deepfake CFO call resulted in a $25M wire transfer). Adversarial AI techniques craft inputs that evade ML-based detection (adversarial examples, model inversion, data poisoning). LLMs are used to automate reconnaissance, summarize leaked data, write malware variants, and operate as autonomous agents that coordinate multi-stage attacks. Defenses include AI-powered detection (the same AI techniques are used defensively), robust prompt engineering and output filtering, and zero-trust principles that don't rely on AI for trust decisions.
Cloud Misconfiguration
Misconfiguration remains the leading cause of cloud breaches. Common patterns: public S3 buckets and blob storage, overly permissive IAM roles (the Capital One breach of 2019 affected 100M records because of a misconfigured WAF), unrestricted security groups and network ACLs, unencrypted data at rest, hardcoded secrets in source code repositories, and excessive use of long-lived access keys instead of short-lived credentials. Defenses: CSPM tools (Wiz, Prisma Cloud, Lacework), AWS Config and Azure Policy for continuous compliance, infrastructure-as-code scanning (Checkov, tfsec, Snyk IaC), and a strong cloud security architecture review process.
Top Frameworks and Standards
NIST Cybersecurity Framework 2.0
The most widely-cited security framework globally. Version 2.0 (released February 2024) added the Govern function to the original five (Identify, Protect, Detect, Respond, Recover), making six functions total. Govern focuses on enterprise risk governance, supply chain risk, and the organizational context that informs security decisions. NIST CSF 2.0 also added a dedicated Quick-Start Guide for small businesses, profiles for specific sectors (including healthcare, manufacturing, and government), and improved mapping to other frameworks (NIST SP 800-53, ISO 27001, COBIT, CIS Controls). NIST CSF is voluntary but is referenced in US federal regulations (SEC cybersecurity disclosure rules, HIPAA, financial services), state-level regulations (NY DFS 23 NYCRR 500, California's SB-1386), and is the de facto baseline for many multinational corporations.
ISO/IEC 27001:2022
The international standard for Information Security Management Systems (ISMS). Certification-driven: organizations achieve ISO 27001 certification through accredited third-party audits. The 2022 revision replaced the 2013 version with updated controls (93 Annex A controls organized into 4 themes: organizational, people, physical, technological) and a stronger emphasis on risk management and leadership commitment. ISO 27001 is the most-recognized certification for vendor security globally, especially for SaaS companies selling to European and multinational customers. For US companies selling primarily to US enterprise customers, SOC 2 is more common.
SOC 2 (System and Organization Controls)
AICPA's framework for evaluating the security, availability, processing integrity, confidentiality, and privacy of a service organization's systems. SOC 2 Type I evaluates the design of controls at a point in time; SOC 2 Type II evaluates the operating effectiveness of controls over a period (typically 6-12 months). SOC 2 is the de facto security standard for US SaaS companies, and most enterprise customers require SOC 2 Type II from their critical vendors. The 2024 AICPA update added more explicit guidance on cybersecurity risk management and clarified the criteria for the Security and Availability categories.
PCI DSS 4.0
The Payment Card Industry Data Security Standard, version 4.0 (effective April 2024, replacing 3.2.1). Mandatory for any organization that stores, processes, or transmits cardholder data. PCI DSS 4.0 added more flexibility (the customized approach for meeting controls), stronger authentication requirements (MFA for all access to cardholder data), and better alignment with modern software development practices. The full enforcement deadline is March 31, 2025, with future-dated requirements extending to 2026-2027.
Career Paths in Cyber Security
Cyber security careers are organized into roughly seven role families. US salary bands below are based on 2026 market data and vary by region, company size, and specialization.
Security Operations (SOC, Incident Response, Threat Hunting)
Entry point for most cyber security professionals. Roles: SOC Analyst Tier 1 (alert triage, basic investigation), Tier 2 (deeper investigation, escalation), Tier 3 (advanced threat hunting, custom detection); Incident Response Analyst; Threat Hunter; Detection Engineer. Salary bands 2026: SOC Analyst Tier 1 $55-75K, Tier 2 $75-100K, Tier 3 / Senior $100-140K, Threat Hunter / Detection Engineer $120-160K. Common certifications: CompTIA Security+, CySA+, BTL1 (Blue Team Level 1), GIAC certifications (GCIA, GCIH, GCFA), Splunk Certified Power User, SC-200. For a structured entry path, the TutorsBot Cyber Security Analyst Foundation course covers threat modeling, detection, and incident response foundations that map directly to these roles.
Offensive Security (Red Team, Penetration Testing)
Roles: Junior Penetration Tester, Senior Penetration Tester, Red Team Operator, Exploit Developer. Salary bands 2026: Junior $90-130K, Senior $140-200K, Principal/Red Team Lead $200-300K+. Common certifications: OSCP (Offensive Security Certified Professional), OSWE (Web Expert), OSEP (Experienced Penetration Tester), CRTP (Certified Red Team Professional), GPEN, GXPN. Path requires strong networking, OS, and programming skills; the work is demanding but well-compensated.
Cloud Security
Roles: Cloud Security Engineer, Cloud Security Architect, DevSecOps Engineer. Salary bands 2026: Engineer $130-180K, Senior/Architect $180-260K+. Common certifications: AWS Security Specialty, Azure Security Engineer Associate, GCP Professional Cloud Security Engineer, CCSP (Certified Cloud Security Professional), CCSK. Strong overlap with DevOps and Site Reliability Engineering.
Application Security (AppSec)
Roles: Application Security Engineer, Product Security Engineer, DevSecOps Engineer, Security Champion (within development teams). Salary bands 2026: Engineer $120-170K, Senior $170-220K. Common certifications: GWAPT, GWEB, CSSLP, OSWE. Strong programming background required.
Identity and Access Management (IAM)
Roles: IAM Engineer, Identity Architect, Privileged Access Management Specialist. Salary bands 2026: Engineer $115-160K, Architect $160-220K. Common certifications: CIAM, Okta Certified Professional, Microsoft Identity and Access Administrator Associate, CyberArk Defender / Sentry.
GRC (Governance, Risk, Compliance)
Roles: GRC Analyst, Risk Analyst, Compliance Analyst, Internal Auditor, Privacy Officer. Salary bands 2026: Analyst $80-120K, Senior/Manager $120-170K, Director $170-250K. Common certifications: CISA, CISM, CRISC, CIPP/US, CIPM, ISO 27001 Lead Auditor. Strong fit for candidates with auditing, compliance, or risk management backgrounds. The TutorsBot Governance, Risk and Compliance training covers the audit frameworks, regulatory requirements, and risk assessment that map to these roles.
Security Leadership
Roles: Security Manager, Director of Security, VP of Security, CISO (Chief Information Security Officer). Salary bands 2026: Manager $150-200K, Director $200-300K, VP $300-450K, CISO at mid-market $250-450K base plus significant equity, CISO at enterprise scale $400K-$1M+ total compensation. Requires advanced certifications (CISSP is the gold standard), 10+ years of progressive experience, and demonstrated ability to communicate security risk to executives and boards.
How to Start Learning Cyber Security
Begin with the foundations: networking fundamentals (TCP/IP, DNS, HTTP, routing, subnetting), operating systems (Linux command line, Windows internals), and basic scripting (Python or PowerShell). Then add the security-specific knowledge: CIA triad, threat modeling, common attack patterns, defensive controls, and the legal and ethical context. Hands-on practice is essential - use TryHackMe and HackTheBox for guided learning, build a home lab (even a single laptop with VirtualBox and a few VMs is enough to start), and participate in capture-the-flag (CTF) competitions. Certifications like CompTIA Security+ or Google Cybersecurity Certificate validate the foundational knowledge; later certifications track specialization. For a structured, mentor-guided entry path, the TutorsBot Cyber Security Analyst Foundation course consolidates the curriculum end-to-end.
For related foundational topics, see our What Is Cloud Computing and What Is Machine Learning explainers.
Frequently Asked Questions
Is cyber security hard to learn?
Cyber security has a steep initial curve because of the breadth of foundational knowledge required (networking, operating systems, programming basics) before security-specific concepts make sense. Once the foundations are in place, the field rewards continuous learning and curiosity. Expect 6-12 months to reach an entry-level job-ready state from zero IT background, or 3-6 months if you already have IT helpdesk, networking, or software development experience.
Does cyber security require coding?
Entry-level SOC analyst and GRC roles do not require coding. Mid-level and senior roles (incident response, threat hunting, application security, offensive security, security engineering, detection engineering) use scripting (Python, PowerShell, Bash) regularly. Senior and architect roles use more advanced programming for tool development, automation, and reverse engineering. Plan to learn at least one scripting language (Python is the most common) within your first year.
What is the highest-paid cyber security job?
At the executive level, CISO at large enterprises and Fortune 500 companies has the highest total compensation ($400K-$1M+ with equity). At the senior individual contributor level, principal security architect, distinguished engineer in security, and senior penetration tester / red team lead are the highest-paid roles ($250-400K+ at large tech and financial companies). Specialization in cloud security, AI security, or offensive security commands premium rates. For current US Bureau of Labor Statistics outlook on Information Security Analysts, see the BLS Occupational Outlook - the field projects 33% growth from 2023-2033, much faster than the average for all occupations.
What is the difference between a CISO and a CIO?
CIO (Chief Information Officer) leads the overall information technology strategy and operations of an organization - applications, infrastructure, data, IT teams. CISO (Chief Information Security Officer) is a specialized role focused on information security - protecting the organization's systems, data, and operations from cyber threats. At smaller companies, the two roles may be combined under one executive. At larger organizations, they are separate roles reporting to the CEO or COO, with the CISO increasingly reporting to the board or audit committee for independence.
Is cyber security a good career in 2026?
Yes. The field has a persistent talent shortage (estimated at 4 million unfilled positions globally by ISC2 in 2024), strong salary growth, high job stability (cyber security professionals are needed in every recession and disruption), and clear career progression. The trade-offs: continuous learning is required to keep up with evolving threats, the on-call burden for incident responders can be significant, and the work can be stressful during major incidents. For most people in the field, the rewards significantly outweigh the trade-offs.
Resources and Next Steps
The authoritative sources listed (NIST, CISA, ISO, MITRE ATT&CK, BLS) are the canonical references for frameworks, threat intelligence, and career outlook. For students and career-changers pivoting into SOC analyst, threat detection, or GRC roles, the TutorsBot Cyber Security Analyst Foundation course covers the threat modeling, detection, and incident response foundation that maps directly to entry-level roles. For compliance, risk, and audit careers, the TutorsBot Governance, Risk and Compliance training covers the audit frameworks and regulatory landscape. For related foundational topics, see our What Is Cloud Computing and What Is Machine Learning explainers.
