Skip to content
CertGPS
Industry trend

Certification Job Placement Rates: Why No One Publishes Them

No certification body publishes job placement rates. What a real placement figure requires, what vendors and regulators do publish, and questions to ask a provider.

RB
Rachel Brown
Security Researcher
Published
Updated
Read time
4 min
On this page

Topics

Certification Job Placement Rates: Why No One Publishes Them

A job placement rate counts a defined group of people, waits a fixed time, and checks who is working in the field they trained for. Certification bodies know who passed an exam, but none of them publishes who got hired afterward. So no published placement rate exists for Security+, CISSP or any other security certification, and a figure quoted for one came from somewhere else.

What a real placement figure needs

The closest thing to a standard comes from coding bootcamps. The Council on Integrity in Results Reporting (CIRR), a nonprofit whose members are training schools, requires them to report every student, not a chosen subset. Members record what each student intends from the first day, break employment out at 90, 180 and 360 days after graduation, separate in-field jobs from out-of-field ones, and say whether each job is full-time, part-time, contract, freelance or self-employment. A third party audits the data.

That gives four questions to put to any placement number: who was in the starting group, how long after finishing the count was taken, what counted as a job in the field, and who checked. A certificate exam can't answer the first, because candidates don't enroll anywhere and nobody follows them after the test.

CIRR's own member list shows how thin the coverage is. Its school data page lists current reports for programs in full-stack web development, data science and machine learning. None is a cybersecurity program.

What gets published instead

Vendors publish surveys of their certified candidates. Pearson VUE, which delivers exams for many IT certification programs, released its 2025 Value of IT Certification Candidate Report in April 2025, based on nearly 24,000 respondents. It found that 63% "received a job promotion or anticipated one at the time of the survey," and that 32% received a salary increase after certifying while 41% were hoping for one. The promotion figure combines people who were promoted with people who expected to be, and everyone in the sample chose to answer a survey about a certification they had passed.

Workforce surveys come at it from the other side. The 2025 ISC2 Cybersecurity Workforce Study, an online survey of 16,029 security staff run in May and June 2025, found that 6% of respondents entered the field by earning a cybersecurity certification, and 67% of that group would recommend the route. That tells you a certification-first route works for some people who are now employed. It can't tell you what share of people who tried the same route got hired.

Government programs measure something closer to placement, for a narrow group. Under the Workforce Innovation and Opportunity Act (WIOA), publicly funded job training programs report the share of participants in unsubsidized employment in the second and fourth quarters after they exit, plus their median earnings. The Department of Labor's definitions count any unsubsidized job, so a security course graduate stocking shelves counts as employed, and the figures cover only people who went through those programs.

Claims to question

The Federal Trade Commission has treated bad placement numbers as a legal problem. In October 2021 it sent 70 for-profit colleges a Notice of Penalty Offenses warning that false claims about "the percentage of graduates who get jobs in their chosen field," about "the amount of money a graduate can expect to earn," and about whether a field is in demand could bring civil penalties, at the time up to $43,792 per violation. The same tests work on any training provider that quotes a placement figure:

  • Ask for the starting group and the counted group as two numbers. A rate built only on graduates, or only on graduates who answered a follow-up email, can be high while most enrollees never got a job.
  • Ask how long after completion employment was measured. A 360-day figure will usually run higher than a 90-day one.
  • Ask what "in field" meant. A help desk job is a reasonable first step, but it isn't a security analyst role, and the provider should say which one it counted.
  • Ask whether people who already worked in IT or security before the course are included. Someone promoted internally after certifying is a different outcome from a newcomer hired off the street.
  • Ask who audited the data. "Internal survey" and "independently verified" are different answers.

Where the useful evidence is

If you want to know whether a certification helps people get hired, the honest sources are indirect. Job postings tell you whether employers name it: CyberSeek, the posting tool run by NIST's NICE program with Lightcast and CompTIA, tracks certification requests in listings. Contract requirements such as the Defense Department's 8140 qualification rules tell you where a credential is a condition rather than a preference. And the entry-level job market shows how much competition sits behind each opening.

Our view: treat any "placement rate" attached to a certification as a claim about the people selling it. A certification can move you past a résumé filter and satisfy a contract rule. Whether you get the job still depends on experience, location and timing, and none of the published data separates the certificate's effect from those. For what is known about the people who switch fields, see our piece on career changers in cybersecurity.

Sources