Skip to main content

Chapter 6 — Professional Trends and Future Outlook

The previous chapters covered current professional practice — the roles, ethics, standards, risk management, leadership, and career development that define information security professionalism today. This final chapter looks ahead. AI in cybersecurity is transforming both attack and defence, with profound implications for professional roles and skill requirements. Cloud governance has evolved from emerging concern to mainstream practice, and continues to evolve as multi-cloud, AI-integrated cloud, and edge computing reshape the landscape. Real cases of professional misconduct illuminate what goes wrong and what could be done differently. The persistent underrepresentation of women and other groups in cybersecurity represents both a justice issue and a practical limitation on access to the full talent pool the field needs. This chapter examines each, with the perspective of the MSc graduate entering a profession that will continue to evolve substantially through their career.

6.1 AI in cybersecurity — professional implications​

AI transformation of the profession​

The detailed implications of generative AI for cybersecurity are covered in ENCTNS615. This section focuses specifically on professional implications — how AI affects the roles, skills, and career trajectories of security professionals.

What AI does for the professional​

Productivity multiplication. A SOC analyst with AI assistance processes more alerts. A pentest report writer with AI assistance produces more reports. A compliance professional with AI assistance handles more frameworks.

Skill amplification. AI provides expertise the individual may not personally have — translation, niche technical knowledge, framework navigation.

Faster learning. AI accelerates skill development by providing examples, explanations, practice scenarios.

Better outputs. AI-augmented work often higher quality than purely manual.

Time for higher-value work. Routine tasks automated; humans focus on judgement and stakeholder engagement.

What AI demands from the professional​

AI literacy. Understanding what AI can and cannot do.

Prompt engineering. Effective interaction with AI tools.

Critical evaluation. Recognising AI errors and hallucinations.

Tool selection. Knowing which AI tools fit which problems.

Ethical judgement. When and how to use AI appropriately.

Continuous learning. Tools evolve continuously.

Adaptation. Roles change; willingness to adapt matters.

Role evolution​

How specific roles change:

SOC analyst. From manual triage of every alert to validation of AI triage. Focus shifts to complex investigations and threat hunting.

Penetration tester. AI assists testing; tester focuses on creative attack development and client interaction.

Security engineer. AI assists with implementation; engineer focuses on architecture and integration.

Compliance professional. AI processes documentation; professional focuses on judgement on borderline cases and stakeholder relationships.

Incident responder. AI assists analysis; responder focuses on coordination and decision-making.

Security architect. AI assists with documentation and standard solutions; architect focuses on novel design and stakeholder engagement.

CISO. AI augments management and reporting; CISO focuses on strategy, relationships, and leadership.

Across roles, the pattern is consistent: AI handles routine work; humans focus on judgement, creativity, relationships, and accountability.

Skill implications​

Skills increasing in importance:

Critical thinking. Evaluating AI outputs.

Communication. Stakeholder engagement.

Creativity. Novel problem-solving.

Ethical judgement. Difficult decisions.

Leadership. Managing teams and processes.

Domain expertise. Deep understanding of specific areas.

Cross-disciplinary integration. Connecting different fields.

Skills decreasing in relative importance:

Routine analysis. Increasingly automated.

Standard documentation. AI handles much of this.

Standard configuration. Automated through IaC + AI.

Routine compliance evidence collection. GRC platforms + AI.

This doesn't mean these skills are unnecessary; rather, they no longer differentiate professionals as much.

New roles emerging​

AI security engineer. Securing AI systems.

AI governance specialist. AI risk management, compliance, ethics.

Prompt engineer (for security). Crafting effective security-related prompts.

AI assurance specialist. Testing and validating AI systems.

Adversarial ML researcher. Studying attacks on AI.

LLM operations. Operating LLM-based systems.

These roles are early-stage; will mature over coming years.

Career strategy with AI in mind​

For the MSc graduate planning a career:

Lean into AI. Master AI tools relevant to your role.

Build complementary skills. Skills AI doesn't have — judgement, creativity, relationships.

Develop AI-specific expertise. AI security, AI governance, AI assurance are growing.

Stay technically current. Underlying technical understanding still matters.

Develop business acumen. Translating technical work to business value.

Build leadership capability. Senior roles emphasise human capabilities.

Maintain ethical foundation. AI raises new ethical questions continuously.

Nepali context for AI adoption​

For Nepali professionals:

Tool access. International AI tools available; quality varies for Nepali language.

Skill gap. Few professionals with deep AI security expertise; opportunity for early movers.

Employer adoption. Variable; mature organisations adopting; many catching up.

Cost considerations. API-based AI tools in foreign currency; constraints.

Local capability building. Limited; some at IOE Pulchowk and other institutions.

International remote opportunities. AI-skilled Nepali professionals have substantial international remote work opportunity.

The combination of AI literacy with security skills positions the MSc graduate for substantial opportunity in coming years.

Cloud governance maturity​

Cloud computing has moved from emerging to mainstream over the 2010s and 2020s. Cloud governance — the structures, policies, and practices for directing and overseeing cloud use — has matured correspondingly. Covered extensively in ENCTNS571 (Security and Privacy in Cloud Computing). This section focuses on professional and trend dimensions.

Cloud governance evolution​

Early cloud adoption (2010-2015). Often ungoverned. Departments and developers adopting cloud directly. Shadow IT common.

Recognition phase (2015-2020). Organisations recognising governance need. Cloud Centres of Excellence emerging.

Mainstream governance (2020-2025). Established governance models. CSPM, FinOps, GRC integration.

Mature governance (2025+). Continuous compliance, AI-augmented governance, multi-cloud governance, sustainability inclusion.

Current governance topics​

Multi-cloud governance. Most enterprises use multiple clouds; governance must span.

FinOps. Financial management of cloud — major focus given cost growth.

Cloud-native security. Beyond perimeter; identity-centric.

Sustainability. Carbon footprint of cloud workloads.

Sovereignty concerns. Data residency, vendor control, geopolitical considerations.

AI service governance. New service categories needing governance.

Edge computing. Distributing computation beyond central cloud.

Quantum readiness. Preparation for post-quantum cryptography.

Cloud governance frameworks​

Cloud Security Alliance frameworks. CCM, STAR, others.

NIST cloud-related publications. SP 800-144, 800-145, 800-146, others.

ISO/IEC 27017, 27018. Cloud-specific extensions of ISO 27001.

Provider frameworks. AWS Well-Architected, Azure Well-Architected, GCP Cloud Architecture Framework.

FinOps Foundation framework. Specific to cloud financial management.

Sovereign cloud​

Emerging concept addressing sovereignty concerns:

Definition. Cloud services operated subject to specific national requirements — data location, personnel restrictions, government access controls.

Examples. European sovereign cloud initiatives, country-specific clouds (China, India developments).

Hyperscaler responses. Microsoft Sovereign Cloud, Oracle Sovereign Cloud, Google Sovereign Solutions.

Relevance. Particularly for government, defence, regulated industries.

For Nepali context:

  • No specific sovereign cloud initiative yet.
  • GIDC provides some sovereign-like properties for government.
  • NRB directives address some sovereignty considerations for banks.
  • Likely growing concern as international tensions affect technology decisions.

Cloud governance professional roles​

Specific roles emerging:

Cloud security architect. Cloud-specific architectural responsibility.

Cloud governance lead. Establishing and operating governance frameworks.

FinOps practitioner. Cloud financial management.

Cloud compliance specialist. Cloud-specific compliance.

Cloud platform engineer. Building and operating cloud platforms.

Cloud security operations. Cloud-specific SOC work.

For MSc graduates with cloud security skills, the role market is substantial both in Nepal (banks, IT firms, government) and internationally (remote work).

Cloud certifications​

Vendor-specific:

  • AWS Certified Security – Specialty.
  • Microsoft Certified: Azure Security Engineer (AZ-500), Azure Solutions Architect (AZ-305).
  • Google Cloud Professional Cloud Security Engineer.
  • AWS Solutions Architect (general but security-relevant).

Vendor-neutral:

  • CCSP (Certified Cloud Security Professional, (ISC)²).
  • CCSK (Certificate of Cloud Security Knowledge, CSA).

Cloud certifications increasingly important for security roles. The MSc graduate may pursue vendor-specific certifications matching their environment plus vendor-neutral CCSP/CCSK for broader credentials.

AI in cloud. Increasingly integrated; governance keeping pace.

Quantum-safe cloud. PQC implementation across cloud services.

Sustainability accounting. Carbon footprint tracking; reduction commitments.

Confidential computing. Encryption during processing; broader adoption.

Continuous compliance. Real-time rather than periodic.

Cross-cloud automation. Multi-cloud as standard pattern.

Edge integration. Cloud-edge continuum.

Specialised compliance. Sector-specific cloud regulations.

The MSc graduate's career will see continuing cloud evolution. Building strong cloud foundations now provides foundation for adapting to future developments.

6.3 Professional misconduct and ethics case studies​

Learning from misconduct​

Case studies of professional misconduct illuminate ethical principles. Names and specific details vary; the patterns recur.

Pattern 1 — Conflict of interest unaddressed​

Scenario. A security consultant recommends specific products from a vendor with whom the consultant has undisclosed financial relationship.

Issues:

  • Conflict of interest not disclosed.
  • Recommendation may not be objective.
  • Client unaware of context.
  • Ethical violation under most codes.

Better practice:

  • Disclose financial relationships.
  • Recuse from recommendations affected by conflict.
  • Document disclosures.
  • Manage relationships transparently.

Pattern 2 — Confidentiality breach​

Scenario. A security professional at one firm shares sensitive technical findings with a friend at a peer firm; friend uses information competitively.

Issues:

  • Breach of duty to employer.
  • Breach of duty to clients.
  • Potential legal liability.
  • Damaging to both firms.

Better practice:

  • Confidentiality applies always.
  • Personal relationships do not override professional obligations.
  • Specific obligations under codes of ethics.

Pattern 3 — Going beyond authorisation​

Scenario. A penetration tester, finding interesting items beyond engagement scope, continues exploration without authorisation.

Issues:

  • Beyond contractual scope.
  • Potential legal liability.
  • Damages trust.
  • Even with good intentions, professional violation.

Better practice:

  • Operate strictly within engagement scope.
  • For interesting findings beyond scope, document and discuss with client.
  • Expand scope formally if appropriate.

Pattern 4 — Misrepresentation of capability​

Scenario. A consultant overstates personal experience and certification status to win engagement; delivers work below expected standard.

Issues:

  • Honesty violation.
  • Quality of work suffers.
  • Damages reputation when discovered.
  • Potential legal issues.

Better practice:

  • Honest representation always.
  • If lacking specific capability, decline or partner with capable colleague.
  • Continuous capability building.

Pattern 5 — Audit findings concealment​

Scenario. An internal auditor identifies significant compliance issues; management pressures auditor to soften findings; auditor complies to avoid conflict.

Issues:

  • Audit independence compromised.
  • Stakeholders misled.
  • Risks left untreated.
  • Potential regulatory issues.

Better practice:

  • Audit findings reported accurately regardless of pressure.
  • Documented pushback against management interference.
  • Escalation through audit committee if needed.
  • Resignation if pressure becomes untenable.

Pattern 6 — Insider abuse​

Scenario. Privileged-access administrator uses access to view sensitive personal information for personal interest.

Issues:

  • Direct violation of access controls policy.
  • Privacy violation of subjects.
  • Criminal liability potential.
  • Employment termination likely.

Better practice:

  • Privileged access used only for authorised purposes.
  • Comprehensive logging.
  • Periodic access review.
  • Strong consequences for violations.

Pattern 7 — Incident concealment​

Scenario. Organisation experiences a data breach; senior management decides not to notify affected customers despite legal requirement; security professional acquiesces.

Issues:

  • Legal violation.
  • Stakeholders harmed.
  • Trust violated.
  • Eventual disclosure typically worse than immediate.
  • Personal liability for professional.

Better practice:

  • Insist on legally-required notifications.
  • Document professional opinion.
  • Escalate to board or external counsel if necessary.
  • Consider resignation if requirement not met.

Pattern 8 — IP theft on departure​

Scenario. A security professional leaves employer; takes copies of internal tools, threat intelligence, customer lists to new employer.

Issues:

  • IP belongs to former employer.
  • Potential legal action.
  • Damages reputation.
  • New employer at risk.

Better practice:

  • Personal work and employer work clearly separated.
  • Leave with nothing belonging to former employer.
  • Skills and knowledge go; IP doesn't.

Pattern 9 — Misuse of access for personal benefit​

Scenario. Network administrator uses corporate access to look up personal contacts' information; uses corporate threat intelligence to assess personal investment risks.

Issues:

  • Boundary violation.
  • Policy violation.
  • Trust violation.

Better practice:

  • Access used only for authorised work purposes.
  • Personal matters handled outside work systems.

Pattern 10 — Failure to disclose vulnerability​

Scenario. Security researcher discovers significant vulnerability in widely-used product; offered substantial payment for exclusive access by malicious actor; researcher accepts rather than responsibly disclose.

Issues:

  • Direct facilitation of attack.
  • Criminal liability potential.
  • Ethical violation.
  • Damages researcher community.

Better practice:

  • Responsible disclosure to vendor.
  • Bug bounty if available.
  • Coordinated disclosure with affected parties.
  • Refuse offers for exclusive criminal use.

Lessons from cases​

Misconduct usually starts small. Small compromises lead to larger.

Justifications are often available. Helpful rationalisations make wrong choices feel right.

Consequences accumulate. Bad choices have lasting effects on reputation, career, sometimes liability.

Recovery is difficult. Once professional reputation is damaged, rebuilding is slow.

Better choices were available. In every case, ethical alternatives existed.

Building ethical resilience​

Clear personal principles. What you will and will not do.

Awareness of pressure points. Where you may face pressure.

Support network. Mentors, peers who provide perspective.

Documentation. Records support difficult decisions.

Profession's resources. Codes of ethics, professional body guidance.

Acceptance of cost. Sometimes doing the right thing has cost.

The MSc graduate entering the profession can build ethical resilience from the start. The professionals who maintain integrity through long careers do so through deliberate practice, not just good intentions.

6.4 Gender and diversity in cybersecurity professions​

The diversity gap​

Cybersecurity globally faces persistent diversity gaps. The most-documented gap is gender — women are substantially underrepresented in cybersecurity globally. Other underrepresented groups include various racial, ethnic, and other identity categories depending on geographic context.

Global picture​

Recent industry surveys consistently show:

  • Women comprising roughly 20-25% of the cybersecurity workforce globally.
  • Lower representation at senior levels than entry levels.
  • Pay gaps where comparable data exists.
  • Persistent retention challenges.
  • Gradual but slow improvement over time.

Why diversity matters​

Beyond justice considerations:

Talent pool. The field has chronic shortage; excluding talent worsens shortage.

Performance. Diverse teams typically outperform homogeneous teams on complex problems.

Perspectives. Different backgrounds bring different perspectives to threats and solutions.

Customer alignment. Workforce diverse like customer base understands customers better.

Innovation. Diverse teams more innovative.

Risk management. Different viewpoints catch risks that homogeneous teams miss.

The business case for diversity in cybersecurity is strong; the field has not yet realised it.

Nepali context​

The picture in Nepal:

Tertiary education. Engineering and IT programmes at IOE Pulchowk and other institutions have male majority but significant female enrolment. MSNCS programme cohorts include women though typically as minority.

Industry workforce. Cybersecurity workforce in Nepali enterprises includes women but proportion typically below half. Senior positions especially male-dominated.

Cultural factors. Various cultural expectations affect career paths. Family obligations sometimes constrain certain career patterns.

Specific Nepali context for women in cybersecurity:

  • Increasing entry-level participation.
  • Retention challenges through child-rearing years particularly.
  • Limited senior-role models in some sectors.
  • Migration patterns sometimes more available to men than women.

Beyond gender​

Other diversity dimensions in Nepali context:

Regional. Kathmandu Valley dominance in cybersecurity opportunities; limited opportunities outside.

Caste and ethnicity. Various dynamics affecting career access.

Educational background. IOE graduates have certain advantages; graduates of other institutions navigate different paths.

Socioeconomic. Cybersecurity careers require investment (certifications, time for self-study) that not all aspiring professionals can sustain.

Language. English proficiency affects international opportunity.

What helps diversity​

Approaches that contribute to better diversity:

Inclusive hiring. Broad sourcing; structured evaluation; bias awareness.

Inclusive culture. Workplace where different people thrive.

Mentorship programmes. Senior professionals supporting junior.

Sponsorship. Active advocacy by senior people.

Flexible work. Accommodating various life circumstances.

Pay equity. Equal pay for equal work.

Promotion patterns. Recognising contributions equitably.

Specific support programmes. Women in Cybersecurity (WiCyS), Women in Security and Privacy (WISP), various others globally.

Educational outreach. Building pipeline from early stages.

Specific Nepali initiatives​

For the Nepali context:

Educational outreach. Increasing female student enrolment in IT and engineering.

Career mentoring. Programmes connecting senior with junior professionals.

Professional bodies. Some chapters of international bodies (ISACA, others) have diversity initiatives.

Conferences. Some efforts to increase representation of underrepresented speakers.

Workplace policies. Major employers adopting inclusive practices.

The work is early-stage; significant opportunity for the MSc graduate to contribute to improvements over career.

What the individual professional can do​

Specific actions any professional can take:

Self-awareness. Recognise personal biases.

Inclusive behaviour. In meetings, decisions, evaluations.

Mentoring. Both same-identity and across-identity.

Sponsorship. Active advocacy for underrepresented colleagues.

Hiring practices. Where you have influence on hiring.

Speaking up. When seeing inappropriate behaviour.

Continued learning. About diversity and inclusion.

Pipeline contribution. University outreach, mentoring of students.

Individual actions accumulated across many professionals produce change. The MSc graduate from the start of career can contribute.

Looking forward​

The cybersecurity field will likely become more diverse over coming decades:

  • Demographic trends generally.
  • Recognition of business value.
  • Continued cultural change.
  • Specific industry initiatives.
  • Educational pipeline development.

The pace will be slow but the trajectory positive. Professionals contributing to the change accelerate it.

Synthesis — the profession ahead​

The cybersecurity profession the MSc graduate enters in 2026 will look substantially different by 2050. AI will transform workflows. Cloud will continue evolving (including post-quantum, sustainability, sovereignty considerations). Specific threats and defences will change continuously. Regulations will mature. The profession will become more diverse.

What will persist:

  • The fundamental purpose of protecting information systems and the people who depend on them.
  • The ethical commitments codified in professional codes.
  • The discipline of risk management.
  • The frameworks (evolved versions of today's standards).
  • The need for continuous learning.
  • The value of strong professional networks.
  • The compounding effects of integrity, reliability, and quality work.

The MSc graduate beginning a security career has decades ahead in a profession of substantial importance. The technical knowledge from the broader MSNCS programme provides foundation. The professionalism dimensions from this subject — ethics, certifications, standards, risk management, leadership, communication, career development — provide framework for sustained contribution and growth.

The work matters. The profession needs skilled, ethical, committed practitioners. The opportunities — in Nepal and internationally, in current organisations and emerging ones, in established roles and roles yet to be created — are substantial.

The career begins.

· min read