What are the most critical skills or knowledge areas that cybersecurity programs often fail to teach, but are essential for real-world success in the field?

Honestly, it’s the skill that can’t be taught: Curiosity and Fool around and Find out. Most of the most successful people I know in cybersecurity are people who are constantly exploring the environment. When a new tool comes out, they immediately break it and figure out how it works. Most of us got those skills because we had to. The first computers we owned, we had to build ourselves, and that came with a lot of trial and error and breaking and things burning, screaming, that sort of thing. I always see students who want someone to hand them a checklist they can follow, memorize, and then write down on an exam. Real-world success is found in people who want to explore, see something they don’t know, learn that thing, apply that to the real world, and then start again tomorrow. The other thing I can’t teach you is to enjoy this stuff. I see people that are really good, having so much fun figuring things out. My old friend Lou and I spent many, many hours trying to get his elaborate sound card to work with Gentoo Linux. I finally had to learn how to write custom code to even get it to make noise. It never worked correctly, but I learned a LOT about Gentoo, linux, and Turtle Beach sound cards in the process. When Lou and I decided that we should learn overclocking, we built some machines and then, well, ended up melting a CPU because it got so hot, and we forgot it was running. Luckily, it didn’t burn his house down, but it wrecked the CPU and motherboard. But again, we learned something (mostly, not to drink and overclock), but we learned. I learned almost everything I know by building things, trying to figure things out, etc. Cybersecurity didn’t exist when I went to school (Programmer by trade), so I learned it when someone asked me how.

So, reverse engineer (legally), break things (legally), and figure out how things work—those are the real skills. Certainly, you need a background in programming and networking. I can teach you those, but I can’t make you go home and take a router apart to see how it works. If you aren’t having fun, it’s not worth it.