How do you gain “experience” in cyber without a job in cyber?

This briefing explores the cybersecurity workforce “expectations gap,” citing IBM, SANS, and ISACA data showing that many roles require degrees and 3–5 years of experience while organizations still struggle to find specialized talent. It argues for rethinking hiring by valuing non-traditional, hands-on pathways—such as competitions like the Cyber 9/12 Strategy Challenge—to provide demonstrable experience and better align skills with industry needs.