The Bureau of Labor Statistics says it "never has attempted to estimate the number of times people change careers," because nobody agrees on what a career change is. So any percentage of career changers who make it into security is someone's guess. What does exist is survey data on how today's security staff got in, and it points to a two-step route through IT far more often than a direct jump.
Why there's no rate to quote
A rate needs a denominator: everyone who tried to switch, followed for long enough to see where they ended up. No public dataset tracks that group for security. The large workforce surveys ask people who already work in the field, so anyone who studied for a year, applied, and went back to their old job never appears in the sample.
The BLS does track something nearby. Its National Longitudinal Survey of Youth 1979 found that people born from 1957 to 1964 held an average of 12.7 jobs between ages 18 and 56. Those are jobs, not careers, and the same FAQ explains why the bureau won't convert one into the other. It asks whether a newspaper reporter who becomes a TV news anchor has changed careers, or a construction worker who starts a remodeling business. A help desk technician who becomes a security analyst sits in the same gray zone.
How people actually got in
The 2025 ISC2 Cybersecurity Workforce Study surveyed 16,029 people responsible for security in May and June 2025, online and in several languages. It asked how each respondent entered the field and whether they would recommend that route.
| Route into cybersecurity (ISC2 2025) | Share of respondents | Would recommend it |
|---|---|---|
| Worked in IT, then took on security duties | 36% | 62% |
| Moved from IT directly into security | 20% | 60% |
| Cybersecurity education | 10% | 61% |
| Worked in another field | 8% | 44% |
| Earned a cybersecurity certification | 6% | 67% |
| Education outside cybersecurity | 4% | 37% |
| Self-taught | 4% | 50% |
| Military | 3% | 49% |
| Internship or apprenticeship | 3% | 69% |
The classic career changer, someone who worked in another field, is 8% of respondents. ISC2 found the highest career-changer shares among people from legal, real estate, retail and construction backgrounds, under 10% for each. Younger respondents came in by more varied routes. Among those aged 21 to 29, 38% entered through IT, 38% through other routes such as certification, self-teaching or a career change, and 23% through a cybersecurity degree. By age 45 and over, about 65% had come through IT.
Read the sample before the shares. Only 5% of ISC2's respondents describe themselves as entry-level staff, and 42% hold a master's degree, so the table describes how established professionals got in, years ago in many cases. It can't tell you how this year's applicants are faring.
ISACA's employer-side numbers look very different, and the wording explains why. In its State of Cybersecurity 2026 survey of more than 1,800 professionals, 54% said half or more of their cybersecurity staff "started in a different field and transitioned to cybersecurity." A help desk technician who moved into the security team counts as a transition in that question and as IT experience in ISC2's. ISACA's 2025 release added a warning sign: only 29% of enterprises were training non-security staff to move into security roles, down from 41% the year before.
What the BLS figures add
The Occupational Outlook Handbook says information security analysts "may need to have work experience in a related occupation," and names network and computer systems administration as a common one. The bureau counts 192,900 analyst jobs in 2025 and projects 21% growth to 2035, with about 14,100 openings a year.
Those openings come from growth and from people leaving. BLS projects that 3.1% of information security analysts will move to a different occupation each year from 2025 to 2035, against 5.5% across all occupations. People who reach the analyst title tend to stay in it, which helps them and leaves fewer vacated seats for newcomers.
Reading the claims you'll meet
A training provider's "career changers placed" figure depends on who it counts. Ask how many people started, how many finished, how long after finishing the count was taken, and whether a help desk job counts as security. We cover what a proper outcomes report contains in our article on certification job placement rates.
A vendor survey of certification holders comes from people who passed and chose to answer. It can describe that group, but it says nothing about people who started and stopped. An employer survey like ISACA's records managers' impressions of their teams, which is useful but less precise than a count.
Our view: the data supports a two-step plan for most career changers. Get into an IT or IT-adjacent job first, take on security duties there, then move. That is how more than half of ISC2's respondents got in, and they recommend it at 60% or more. The direct jump from an unrelated field is real but small, and the people who made it were among the least likely to recommend it, at 44%. Our IT-to-security transition guide sets out that route stage by stage.
Sources
- BLS National Longitudinal Surveys FAQ: no estimate of career changes, 12.7 jobs from ages 18 to 56, checked October 2026
- 2025 ISC2 Cybersecurity Workforce Study: summary and publication date, checked October 2026
- 2025 ISC2 Cybersecurity Workforce Study report (PDF): pathways, recommendation rates, age breakdown, methodology, participant details, checked October 2026
- ISACA State of Cybersecurity: 2026 survey, 1,800+ respondents, 54% staff transitioned from a different field, checked October 2026
- ISACA State of Cybersecurity 2025 press release: training non-security staff, 29% against 41%, checked October 2026
- BLS Occupational Outlook Handbook: Information Security Analysts: related experience, 2025 jobs, 2025 to 2035 outlook, annual openings, checked October 2026
- BLS Occupational Separations and Openings, 2025 to 2035: occupational transfer rates, checked October 2026