This retrospective looks at ten cybersecurity certifications that were relevant to security careers around 2019, a period when organizations were paying more attention to ransomware, data protection, cloud adoption and professional security roles. The list preserves the historical question that candidates were asking at the time: which skills and credentials might help them move into better-resourced security work? It is not a live ranking of 2026 salaries, and the current versions of the certifications should be checked with their issuers before making a purchase or training decision.
A certification may improve the clarity of a candidate’s professional profile, but compensation depends on actual responsibilities, geography, experience, seniority and the employer’s needs. These ten credentials are editorial examples of different 2019 career directions rather than positions in a measured salary league table: no comparable, independently verified 2019 salary dataset establishes the claimed ordering. The most useful comparison is therefore about the work each credential emphasizes—leadership, audit, risk, operations, cloud architecture or ethical testing—rather than treating the word “lucrative” as a promise of specific earnings.
Certified Information Systems Security Professional CISSP
The ISC2 Certified Information Systems Security Professional (CISSP) credential was associated with experienced security leadership and architecture work. Its broad body of knowledge addresses security and risk management, asset protection, architecture, networks, identity, assessment, operations and software security. This breadth matters because a security architect often has to weigh competing controls instead of selecting a single product. The official domain structure evolves, so readers considering the credential now should consult the current CISSP exam scope rather than copying preparation advice or topic weights from 2019.
A distinction sometimes lost in older career discussions is the difference between passing the CISSP examination and being awarded the full CISSP credential. ISC2’s experience and endorsement requirements apply to certification, not to a universal prohibition on taking the examination before gaining enough experience. Candidates who pass without satisfying the experience standard can pursue the Associate of ISC2 pathway while earning qualifying experience. For hiring decisions, a certificate alone does not establish that a person has performed every security-management task; ask what controls, teams and operational responsibilities the candidate has actually handled.
Certified Information Security Manager CISM
The Certified Information Security Manager certification, issued by ISACA, focused heavily on the managerial and governance aspects of information security rather than purely technical implementation skills. Throughout 2019, this certification proved particularly attractive to professionals looking to transition from technical security roles into positions involving strategic planning, risk management, and organizational leadership. The exam covered four core domains, including security governance, risk management, program development, and incident management.
CISM can be relevant when a professional’s work moves from technical implementation toward directing a security program, communicating risk to leaders and setting an incident-management strategy. It is not a universal higher-paid replacement for a technical qualification. Organizations may value CISM differently from an audit-centered CISA or a risk-focused CRISC, depending on the role they are filling. A comparison of CISA, CISM and AAISM illustrates why related ISACA credentials should be judged by responsibility and program scope rather than treated as salary tiers.
Certified Ethical Hacker CEH
EC-Council’s Certified Ethical Hacker (CEH) gained attention as an entry point into penetration-testing terminology, attack methods and defensive thinking. It is important, however, not to describe every CEH holder as having passed a hands-on exploitation examination. EC-Council distinguishes its knowledge-oriented multiple-choice CEH assessment from an additional CEH Practical assessment involving live challenges; the current Master designation builds on both. Candidates comparing an older 2019 CEH syllabus with a modern offering should verify which examination and training bundle is actually being advertised.
In offensive-security hiring, authorization, careful documentation and the ability to reproduce a finding matter more than a certificate’s marketing language. A candidate preparing for CEH may benefit from practicing safe network discovery, vulnerability analysis and remediation explanations in permitted labs, but should not represent the knowledge examination as proof of an independent penetration test. Some positions require deeper practical assessment and prior systems experience. A prospective student should compare the actual duties of a vulnerability assessor, junior security analyst and penetration tester before deciding whether CEH addresses the desired career direction.
CompTIA Security Plus Certification
CompTIA Security Plus served as an excellent entry point into the cybersecurity field throughout 2019, providing foundational knowledge that many employers required for even junior level security positions. This vendor neutral certification covered essential topics such as network security, compliance, operational security, and threats and vulnerabilities. Its broad applicability across different technology environments made it a popular choice among professionals just beginning their security careers.
Security+ offered a useful foundation for candidates who needed to understand authentication, network protection, incident handling, cryptographic concepts and risk terminology. Some public-sector and contracting jobs referenced recognized security qualifications, but requirements depended on the position and relevant policy, not an unconditional rule that all government security jobs demanded Security+. Earlier exam codes and topic distributions must be treated as historical. Someone preparing today should review the current Security+ blueprint and the actual vacancy’s qualification requirements rather than assuming that a 2019 credential version remains available.
Certified Cloud Security Professional CCSP
The ISC2 Certified Cloud Security Professional (CCSP) addressed security principles across cloud service models and was developed with early Cloud Security Alliance involvement. ISC2 is the credentialing organization; it is inaccurate to describe current CCSP certification as though two independent issuers separately award it. Cloud-security work connects data classification, contracts, provider responsibility, application controls and incident response. This made CCSP relevant to people encountering cloud migration and hybrid risk questions in the 2019 period, but its value is better explained by the work it covers than by an unsupported specific salary premium.
CCSP’s practical distinction is its cross-provider perspective: an engineer must know which party manages a control, what evidence proves it is configured, and how data-location and recovery requirements change under IaaS, PaaS and SaaS. That knowledge can transfer between organizations, but provider-specific tools, privileges and service contracts still require fresh learning. Professionals evaluating CCSP cloud security skills now should use the current ISC2 experience rules and exam outline rather than assume the 2019 market situation, item formats or hiring patterns remain identical.
Offensive Security Certified Professional OSCP
The Offensive Security Certified Professional certification developed a reputation throughout 2019 as one of the most technically demanding and respected credentials within the penetration testing community. Unlike many certifications that relied primarily on multiple choice examinations, OSCP required candidates to complete a rigorous hands on practical exam, demonstrating their ability to actually compromise systems within a controlled environment.
The OSCP’s practical assessment offered a different kind of professional signal from a purely knowledge-based examination: candidates needed to demonstrate technical problem-solving within a permitted lab environment. That does not guarantee an advanced red-team position, nor does it erase the importance of reporting, exploit safety and remediation advice. A hiring manager should still ask about scope control, documentation and methodical troubleshooting. Current OSCP delivery, prerequisites and lab materials may differ from those available in 2019, so contemporary candidates must verify the present program directly with OffSec.
GIAC Security Essentials Certification GSEC
GIAC Security Essentials (GSEC) is a GIAC-issued certification that validates security knowledge and practical operational understanding. SANS Institute provides related security training, including courses aligned to GSEC, but the training organization and the independent certification body are not interchangeable. SANS completion is not required to earn a GIAC credential and does not guarantee exam success. That distinction matters when assessing a course advertisement or comparing a self-study route with an instructor-led program. Candidates should check the applicable GIAC examination rules and the issuer’s current coverage rather than relying on historical assumptions.
GSEC can fit security engineers, administrators and analysts who need depth beyond basic security vocabulary. Relevant work includes network defense, access control, logging, cryptography and incident response. Someone managing enterprise controls may derive value from the learning, while a specialist role might demand a more focused qualification instead. The original 2019 conversation often linked expensive technical training with high compensation, but completing a course is not evidence of a salary premium. The decision should weigh the course or examination expense against concrete technical responsibilities and available employer sponsorship.
Certified Information Systems Auditor CISA
The Certified Information Systems Auditor certification, also issued by ISACA, focused specifically on information systems auditing, control, and assurance throughout 2019. While not exclusively a security certification, CISA held significant relevance for professionals working at the intersection of security and compliance, particularly within heavily regulated industries such as finance and healthcare.
CISA’s value is clearest in roles that require independent assessment of controls and defensible audit evidence. It does not, by itself, make an organization compliant with a regulation, and a credential holder still needs to understand the business system and applicable audit standard. Modern candidates can refer to the current CISA exam scope for the issuer’s latest role boundaries; it should not be back-projected into a claim about the exact 2019 syllabus. Auditing, information-security operations and risk ownership may overlap, but they are not the same job.
Certified in Risk and Information Systems Control CRISC
The Certified in Risk and Information Systems Control certification, another ISACA credential, gained increasing recognition throughout 2019 as organizations placed greater emphasis on enterprise risk management practices. This certification validated a professional’s ability to identify and manage IT risk while implementing appropriate information systems controls to mitigate potential threats to organizational objectives.
CRISC may be useful to professionals who translate a technology risk into potential business loss, determine whether controls are proportionate and help track residual risk. For example, a security team can identify an exposed cloud service, but a risk professional may need to evaluate its business context, responsible owner, treatment plan and management reporting. That distinction explains why CRISC can complement technical certifications without being a direct substitute for them. Claims of particularly high 2019 salaries would require a reliable contemporary survey with clear sample and location information, which this article does not provide.
Systems Security Certified Practitioner SSCP
The Systems Security Certified Practitioner certification, offered by ISC2, served as a popular option throughout 2019 for technical professionals seeking validation of their hands on security implementation skills. This certification differed from more managerially focused credentials by concentrating on the technical and operational aspects of security, including access controls, cryptography, network security, and incident response.
SSCP may be a sensible technical credential for people responsible for implementing and operating access controls, security monitoring, network protections and incident procedures. Its emphasis differs from the broader security-management and architectural judgment commonly associated with CISSP. A reader weighing SSCP and CISSP should compare required experience, intended role and actual examination objectives instead of assuming that either title automatically produces a particular salary. Both qualifications are more useful when a candidate can explain real security operations carried out safely and with appropriate authority.
Conclusion
Looking across these ten credentials reveals several distinct ways security work was being professionalized around 2019. CISSP and CISM emphasized broad security judgment and program leadership; CISA and CRISC related to assurance and enterprise risk; Security+, SSCP and GSEC covered increasingly practical operational knowledge; CCSP addressed cloud-security decisions; and CEH and OSCP were associated with offensive-security paths of differing assessment types. These are professional specializations, not ten equivalent tickets to the same job. The position and employer determine which evidence of skill is most relevant.
This is a historical comparison, not a current salary survey or an independently ranked table of 2019 compensation. The original premise that a certification might be lucrative should be understood as a possible relationship between specialist skills and certain responsibilities, not a proven premium for every holder. Exact 2019 salary claims would require period-specific, role-adjusted, geographically comparable data that is not supplied here. Later changes to exam content, issuer policies and hiring requirements also mean that candidates should never use a dated credential article as their sole source of current purchasing information.
The enduring lesson is to start with the job and the work, then select a credential that helps build and demonstrate the relevant capability. A prospective security leader should assess governance experience; an auditor should focus on controls and evidence; a cloud engineer must understand platform responsibility; and a penetration tester needs authorized, reproducible technical skills. Use issuer documentation for current exams and experience rules, validate training costs and renewal obligations, and seek practical opportunities to apply what you learn. Neither the 2019 market context nor the certification label can guarantee a salary or career outcome.