Skip to content
CertGPS
Industry trend

Boot Camp or Self-Study: The Outcome Data That Exists for Each

We found no matched study of boot camps and self-taught security candidates. ISC2 data, online learning research and disclosure rules show what can be checked.

RB
Rachel Brown
Security Researcher
Published
Updated
Read time
4 min
On this page

Related certifications

Topics

Boot Camp or Self-Study: The Outcome Data That Exists for Each

ISC2's free Certified in Cybersecurity program left a rare record of self-study at scale. More than a million people enrolled, more than 570,000 finished the course, and more than 65,000 earned the certification. We found no comparable security boot camp dataset or matched comparison of the two routes. The data that does exist says a good deal about who finishes and very little about who gets hired.

What a free, self-paced route produced

ISC2 launched its One Million Certified in Cybersecurity program in 2022, offering the online self-paced CC course and the exam at no charge. Its 2025 annual report gives the funnel: more than one million enrollments in under four years, more than 570,000 course completions, more than 65,000 new CC holders, and nearly 9,000 who went on to a second, more advanced ISC2 certification. The program concludes in 2026, and our piece on the end of the free CC program covers what remains free.

Dividing the rounded totals gives roughly one certification per 15 enrollments, or per nine course completions. These are snapshot ratios, not a tracked cohort's eventual completion rates. The course and exam were free, but study time and ISC2's $50 annual fee after certification still carried costs. Free enrollment may also have attracted people who were only curious.

What paying and intending do to completion

One of the largest public datasets on self-paced online courses comes from Harvard and MIT. Justin Reich and José Ruipérez-Valiente analyzed every course the two universities ran on edX from 2012 to 2018, 12.67 million registrations from 5.63 million learners, and published the results in Science in 2019. Of those who registered, 52% never entered the course material. In 2017-18, 3.13% of all participants completed their course, against 15.42% of those who had said in a survey that they intended to finish, and 46.02% of those who paid for the verified certificate track.

That gap, from 3% to 46%, bears directly on what boot camps sell. People who commit money and say they mean to finish complete far more often. The data can't separate cause from selection: people who pay may simply be the ones who were going to finish anyway. Either way, the group with nothing at stake, the free registrants, had the worst completion record.

What boot camps must disclose

California requires outcome disclosure in a standard form. Under the California Private Postsecondary Education Act, a covered private school must give prospective students a School Performance Fact Sheet before enrollment, with completion rates, placement rates for any program that claims to prepare students for a career, and salary information. The law defines completion as finishing within the published program length, and counts graduates as placed if they're working in the field within six months.

The rule has gaps. Among the exemptions are public institutions and non-degree schools charging $2,500 or less when no state or federal aid is involved. And the fact sheet's exam figure covers only state licensing exams, while security certifications are issued by private bodies, which is how the Bureau of Labor Statistics separates a certification from a license. A California fact sheet will tell you how many students finished and found work, but not how many passed Security+.

Elsewhere, look for voluntary reporting; the standard some coding schools use is covered in our article on certification job placement rates.

When outcome claims go wrong

The Consumer Financial Protection Bureau's April 2024 order against BloomTech, a coding boot camp formerly called Lambda School, shows how far advertised and internal figures can drift. The CFPB found that the school advertised placement rates of 71% to 86% while its non-public reporting to investors showed rates closer to 50%, and as low as 30% in some cases. The order permanently banned BloomTech from consumer lending and imposed more than $164,000 in civil penalties on the company and its chief executive. BloomTech taught software development rather than security, but any boot camp quoting a placement figure can be asked the same questions.

What the field's own survey says

The 2025 ISC2 Cybersecurity Workforce Study, an online survey of 16,029 security staff, asked how people got into the field. It has no boot camp category. Earning a certification was the route for 6%, and exploring cybersecurity on their own for 4%. Asked whether they'd recommend their route, 67% of the certification group said yes, against 50% of the self-taught. Those figures describe people who made it into the field, so they say nothing about how many tried each route and didn't. Our article on career changers in cybersecurity takes the pathway data further.

Choosing between them

If you've started self-study before and stalled, the edX numbers suggest that putting money and a stated commitment behind a plan goes with finishing it, and a boot camp adds a schedule and an instructor on top. If you finish what you start, money spent on an exam voucher, a lab subscription and an official study guide buys the same certification.

Before paying for a boot camp, ask for completion and placement figures counted from everyone who enrolled, and in California ask for the fact sheet. Also check which exam version the included voucher covers, since several CompTIA exams change in late 2026, as our guide to what to do after a boot camp explains.

Sources