Skip to content
CertGPS
Industry trend

Age in Cybersecurity: What BLS and ISC2 Data Show

Certification bodies don't publish holders' ages. BLS puts the median security analyst at 41.5, and ISC2 shows how the route into the field changes with age.

RB
Rachel Brown
Security Researcher
Published
Updated
Read time
4 min
On this page

Related certifications

Topics

Age in Cybersecurity: What BLS and ISC2 Data Show

On the government's count, information security analysts are slightly younger than the US workforce as a whole, with a median age of 41.5 in 2025 against 42.1 for all workers. Nobody counts the ages of certification holders; we found no age breakdown from ISC2, CompTIA or ISACA. What does exist covers the occupation, ISC2's survey sample and the age rules exam bodies publish.

What the Bureau of Labor Statistics counts

The Current Population Survey, a monthly household survey run for the BLS, puts 261,000 people in the occupation "information security analysts" in 2025. The 2025 figures are 11-month averages, because October 2025 data weren't collected during the federal government shutdown.

Occupation (CPS, 2025)EmployedMedian age
Information security analysts261,00041.5
Software developers2,254,00038.6
Computer systems analysts569,00041.2
Computer network architects96,00045.1
Computer and information systems managers646,00046.4
All employed people163,493,00042.1

The age bands for security analysts are spread wider than the median suggests. Of the 261,000, 73,000 were aged 25 to 34, 68,000 were 35 to 44, 59,000 were 45 to 54 and 37,000 were 55 to 64, with 9,000 aged 65 or older. Only 16,000 were under 25. By those counts about a third of security analysts are under 35, and about four in ten are 45 or older.

Don't mix this count with the BLS Occupational Outlook Handbook's figure of 192,900 analyst jobs in 2025. That one comes from a survey of employers, while the CPS asks households what work people do, so the totals differ. The age data exist only in the household survey. Both cover one occupation code, and plenty of security work sits under other titles, such as the managers in the table above.

Who answers the profession's own survey

The 2025 ISC2 Cybersecurity Workforce Study, an online survey of 16,029 people run in May and June 2025, skews older than the BLS count. Only 2% of its respondents were 24 or younger and 8% were under 30. The largest group was 40 to 44, at 17%, and 25% were 50 or older. With 42% holding a master's degree and only 5% describing themselves as entry-level, the sample reads as established professionals, which matters whenever someone cites it as a portrait of the field.

How the route in changes with age

ISC2's most useful age finding is about pathways. Among respondents aged 21 to 29, 38% entered through IT, 38% came in by other routes such as certification, self-teaching or a career change, and 23% through a cybersecurity degree. The IT share climbs with age, to 54% of those aged 30 to 44, 64% of those 45 to 59, and 65% of those 60 and older.

Degrees move the other way. A cybersecurity degree was the route for 23% of respondents aged 21 to 29, 13% of those 30 to 44, 6% of those 45 to 59 and 3% of those 60 and older. The field's older members mostly arrived as IT staff who took on security work. For someone changing careers at 45, the data describe a route through an IT or IT-adjacent role more often than a direct entry, which our article on career changers in cybersecurity covers in detail.

The age rules that are published

Exam bodies do set lower limits. ISC2 says you must be 16 to sit any of its exams, including CC, and a parent or guardian must come to the test center with a candidate under 18. CompTIA has required parental consent through its CompTIA Central accounts since June 23, 2026 for candidates 17 and under who want to register for an exam such as Security+.

The experience rules set a practical floor higher up. CISSP requires five years of full-time security work in at least two of its eight domains, with one year waivable for a degree or an approved credential. A CISSP holder is rarely a new graduate for that reason alone, which is why claims about the "average age of CISSP holders" tell you about the experience rule more than about who chooses the field.

At the other end, US law protects older applicants. The Equal Employment Opportunity Commission says the Age Discrimination in Employment Act "forbids age discrimination against people who are age 40 or older," in hiring, pay, promotion, training and other terms of employment.

Reading age claims

When you see an average age for a certification, ask who measured it. If it comes from a vendor survey, the sample is people who chose to answer; if it comes from job-site profiles, it covers people who post their history online. Check whether the figure is a mean or a median, since a few long careers pull a mean upward.

Our view: the government data don't support the idea that security is a young person's field. Four in ten analysts are 45 or older. Older entrants do tend to arrive through IT, so for a career changer in their forties the question to ask is whether to take an IT role first, and age itself shouldn't settle it.

Sources