Do certifications matter?

Welcome to the CISO Perspectives Weekly Briefing, where we break down this week’s conversation, providing insights into relevant research and information to help you further understand the topics discussed.

At 600 words, this briefing is about a 5-minute read.

The value of certifications.

A constant question in cybersecurity revolves around the value of certifications. However, despite the criticisms of many certifications, there is evidence that not only supports their value to the individual but to organizations.  

In the 2024 ISC2 workforce study, they found the following:

• 90% of respondents who obtained a certification before entering the workforce found it to be either valuable or very valuable.
• 65% of respondents either somewhat or completely agreed that certifications were the best way to prove knowledge and understanding. 

Outside of certifications helping prove knowledge, they have also aided employees in gaining opportunities. In a 2023 Pearson Vue study, they found the following:

• 83% of those who obtained a certification received a pay increase within six months.
• Notably, 58% saw their pay increase within three months.
• 27% received job promotions due to the certification.
• 92% felt more confident in their abilities after earning a certification.
• 74% found they had greater autonomy and independence while working.

Alongside the benefits certifications provide to the workforce, there are notable benefits for businesses. In Pearson Vue’s report, they found the following about certification holders:

• 81% reported increased quality and value of work contributions.
• 71% demonstrated greater efficiency and productivity.
• 77% reported an increase in their ability to innovate and enhance work processes.
• 82% reported a greater ability to mentor and support co-workers.

The tangible benefits that certifications can bring to employees are noticeable and impactful. Due to these benefits, it should not come as a surprise that hiring managers want prospective talent to possess these certifications. In the SANS 2025 Workforce Report, they found the following:

• Certifications ranked as the second most important qualification when evaluating potential hires.
• Only technical capabilities ranked higher.
• 65% of organizations required certifications for client-facing purposes.
• 58% of organizations required certifications for internal decision-making.
• 55% of organizations have formalized training programs for cybersecurity staff, with certification-based training being one of the most consistent approaches implemented.

However, while these reports and findings support the value of certifications as a whole, this does not mean obtaining a certification translates to instant success.

The weight of certifications.

While certifications are a valuable tool, understanding what certification to obtain and how to utilize that certification is just as important for prospective talent and organizations.

According to Cyberseek, the top three most demanded certifications are:

1. CISSP (70,000 requesting jobs)
2. Security+ (63,000 requesting jobs)
3. CISA (46,000 requesting jobs)

Conversely, the top three most obtained certifications are:

1. Security+ (266,000 certification holders)
2. CISSP (92,000 certification holders)
3. GIAC (46,000 certification holders)

While there is some overlap and disconnect between what organizations want and what prospective talent has, simply obtaining one of these certifications is not going to translate to instant career advancement or business success. Rather, certifications should be used as a piece of the puzzle for both businesses and individuals alike. 

Businesses and individuals need to understand what standards and skills certifications can bring to an organization and what skills are needed for positions. Emphasizing skill-based hiring and understanding what baseline skills are presently needed along with what skills can be developed later is critical when finding talent. Certifications cannot be treated as a monolith for hiring success nor can they be used as a sole way to validate skills. Instead, certifications should be used as a way to focus on what skills talent brings to the table and what organizations want for their open roles.