Video summary

AI Will Replace Most Jobs… Except These in Cybersecurity

Main summary

Key takeaways

News and Commentary

Overview

The video argues that AI is already automating significant parts of cybersecurity work and may replace some specializations, while other areas appear comparatively safer. The takeaway is to plan your career around these shifts.

Key claims and analysis

1) AI is accelerating core security tasks

The creator points to examples such as:

  • An AI agent reportedly finding 22 Firefox vulnerabilities without human involvement
  • Claims that AI can perform malware reverse engineering better than humans

This leads to the central question: “Is cybersecurity cooked?”

2) Application security / software security is portrayed as highest risk

The creator groups roles such as:

  • Software security engineers
  • People who find vulnerabilities via secure code review
  • Development
  • Malware reverse engineering

These roles are suggested to be most likely to be automated, though the creator frames outcomes as evolving work rather than total disappearance—especially for senior practitioners who integrate AI into their workflows.

  • For students/career-switchers: the creator discourages starting in appsec/reverse engineering, arguing entry-level opportunities may shrink.

3) Ethical hacking / penetration testing: enhanced, not fully replaced

AI is said to speed up multiple stages of pentesting, including:

  • Reconnaissance
  • Social engineering support
  • Exploit development assistance
  • Reporting

The creator implies that some experienced practitioners may already use AI agents to complete tests with fewer hours per engagement.

However, AI is not expected to replace skilled operators universally. Penetration testers should:

  • Broaden skills
  • Learn to use AI agents
  • Avoid relying only on being a “hacker”

4) SOC / defensive security is argued to be less replaceable than feared

The creator challenges the idea that SOC work is merely alert viewing (and therefore easy to automate). Instead, they claim SOC work is:

  • Highly varied
  • Time-consuming
  • Compounded by organizations lacking enough defenders

AI may still improve:

  • Detection quality
  • Analysis speed
  • Response time

But attackers are also using AI, potentially increasing attack volume and keeping defenders busy. The creator also claims AI lacks business/context understanding, which SOC work often requires.

5) GRC (governance, risk, compliance) is framed as the most resilient

The creator argues GRC is harder to fully automate because it involves:

  • Human assurance
  • Legal obligations
  • Evidence and auditor requirements

AI is presented as useful for tasks like:

  • Summarizing documents
  • Analyzing policies
  • Some report writing

But the creator emphasizes it should not replace accountable professionals. They also claim AI adoption can increase demand for GRC support—particularly for governing AI itself.

6) IAM (Identity and Access Management) is valuable but affected

IAM is described as important and impacted because it depends on many tools and processes. AI may:

  • Enhance auditing
  • Reduce time
  • Potentially reduce headcount

Still, IAM’s complexity and differences across environments mean it will likely still require people. The creator notes overlap paths into IAM, including:

  • Cloud security
  • GRC

7) “Security engineer” roles: mixed risk (with emphasis on cloud security)

“Security engineering” is defined broadly, including:

  • Network security
  • Cloud security
  • Configuring and operating security infrastructure

Many “engineer” roles are portrayed as partially IT-focused, supporting cybersecurity rather than directly performing defense. AI may reduce some work, but the creator believes many roles remain—especially in cloud security.

Key warnings include:

  • Over-specialization in a single technology (e.g., “one-month experience repeated over 20 years”) reduces employability, even without AI
  • Roles essentially limited to automation-only work (e.g., an “automation specialist” writing scripts) are considered more vulnerable to AI replacement

Career guidance (main advice)

Diversify + learn AI strategically

The creator’s core recommendations are:

  • Avoid hyper-specialization in a single area; prioritize adaptability
  • For baseline resilience, build strength in defensive security, GRC, and cloud security
  • For experienced professionals, learn AI agent workflows (e.g., building/creating agents and adding skills into them)
  • For newcomers, start with cybersecurity skills first, then add AI later

Skepticism about “AI certificate” programs

The creator warns against spending time/money on certificates labeled “AI” (e.g., vendor programs with “AI” in the title). The argument is that real progress requires hands-on experimentation—such as building agents—rather than credential chasing.

Contributors mentioned in subtitles

  • The video’s main speaker/creator (unnamed)
  • “A friend of mine” / an “AI threat intelligence expert” (name not given)
  • “A fellow YouTuber” who covered the Firefox vulnerability story (name not given)
  • A “Black Hat Asia” presenter (name not given)

Original video