Who Or What Are Security Professionals/Experts?
Formal education isn't everything. So who's to ascribe titles to people based on occupations?
Suppose I trick some place of work into hiring me based on false assumption/s of qualifications? Does that then somehow imply I do in fact have these qualifications?
Daniel Pocock wrote about this in the past, alluding in part to Molly de Blanc.
Formality sounds like a derogatory term, a red tape.
Without some level of quality assurance, however, any law firm can pretend a paralegal is a Director, a one-person Web site calls its operator "CEO" or "CTO" (depending on one's mood/ego), and people who attack security call themselves the exact opposite of what they are.
In Computer Science (where the "S" stands not for security but for science), people are required to go through rigorous examination to ensure they comprehend all sorts of "boring" things like how network packets are composed, how processors work (at a low level), sometimes even algebra.
Suppose you visit a doctor (medical practitioner, physician) who assures you or or she has many happy patients after learning to diagnose based on Google or training using "ChatGPT". Would you want such people occupying your local clinic?
If we as a society normalise such practices we stand to lose, collectively. Harm will ensue. It would penalise or punish people who still take the "real route" (not diploma mills, either), in turn discouraging the teaching of the craft and leaving us with sloppers (like "vibe coders") and plagiarists (people who 'write books' by prompting for actual author's texts in a "words blender").
Companies like GAFAM are willing to tolerate cheaters because those companies themselves are cheats. █
Image source: Robert F. Kennedy Jr.