Difference Between Cybersecurity and Information Security: 2026 Complete Guide

If you’ve ever sat in a budget meeting and watched two executives argue past each other because one means “cyber security” and the other means “information security,” you already know why this question matters. The difference between cyber security and information security isn’t academic trivia, it decides who owns a budget line, who gets paged during an incident, and whether your organization protects what matters, not just what’s plugged into the network.

Here’s the short version: information security is the broader discipline, covering the confidentiality, integrity, and availability of all information, digital, paper, and everything in between. Cyber security is a subset, focused on defending digital systems, networks, and data from attacks through cyberspace. Every cyber security program lives inside an information security program, but not every information security control is a cyber security control.

That paragraph gets you through most cocktail-party conversations. But if you’re a CEO deciding where to put your next hire, a career-changer choosing a specialization, or an analyst figuring out what to call yourself on LinkedIn, you need the full picture, NIST and ISO definitions, real salary data, a comparison table, and a strategy for making these two functions work together. That’s what this guide gives you.

What Is Cyber Security?

Let’s start with a plain-English answer to “what is cyber security?” before the standards-body language.

Cyber security is the practice of protecting internet-connected systems, networks, servers, endpoints, applications, and the data that flows through them, from attack, damage, or unauthorized access. It’s the discipline built around defending anything that lives in “cyberspace.”

The National Institute of Standards and Technology defines cybersecurity as the ability to protect or defend the use of cyberspace from cyber attacks, where cyberspace refers to the interdependent network of information systems infrastructure, the internet, telecommunications networks, computer systems, and embedded processors that power modern digital life. CISA and ISO describe it similarly: cyber security is specific to the digital domain.

As noted in Gartner’s 2026 Security & Risk Management Summit takeaways, AI-assisted attacks are now a defining factor for programs focused on digital assets.

Examples of Cyber Security in Practice

Concrete examples of cyber security look like the tools and practices your IT and security teams touch every day:

• Firewalls and network segmentation that block unauthorized traffic
• Endpoint detection and response (EDR) on laptops and servers
• Multi-factor authentication (MFA) on cloud logins
• Email security and phishing simulation programs
• Penetration testing and red-teaming of internet-facing applications
• Ransomware detection and containment tooling
• Cloud security posture management (CSPM) across AWS, Azure, and GCP
• Security operations center (SOC) monitoring and threat hunting

Every example above involves something digital. That’s the defining boundary of cyber security, and where information security starts to look different.

What Is Information Security?

What is the definition of information security, and what is a information security program supposed to cover? People searching that phrasing are usually asking one underlying question: how is this different from cyber security, and is it bigger or smaller in scope?

NIST’s Computer Security Resource Center defines information security as protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction, to provide confidentiality, integrity, and availability, the “CIA triad.” Nothing in that definition restricts it to digital information. ISO/IEC 27001, the standard most organizations use to certify an information security management system (ISMS), applies the same CIA-triad logic to information in any form: digital files, printed contracts, boardroom conversations, or handwritten notes.

That’s the core distinction: information security is about the information itself, regardless of medium. Cyber security is about the digital systems that happen to hold a lot of that information today.

Examples of Information Security in Practice

Real-world examples of information security extend well beyond the network:

• Data classification policies (public, internal, confidential, restricted)
• Physical access controls, badge readers, locked server rooms, visitor logs
• Records retention and secure destruction of paper files
• Vendor risk management and third-party data-sharing agreements
• Employee security awareness training and background checks
• Business continuity and disaster recovery planning
• Data loss prevention (DLP) policies covering both digital and physical channels
• Compliance frameworks like ISO 27001, SOC 2, HIPAA, and GDPR

Why Is Information Security Important?

Why is information security important enough to warrant its own discipline, separate from cyber security? Because a huge share of real-world data loss has nothing to do with a hacker breaking through a firewall, a departing employee walking out with a confidential contract, a vendor mishandling customer records, a misfiled HR folder left on a desk. None of that is a “cyber” incident, but all of it is an information security failure, which is why regulators, auditors, and boards increasingly ask about information security posture, not just cyber security posture.

Side-by-Side Comparison Table

This is the fastest way to see the difference between cyber security and information security at a glance.

The practical difference between the two disciplines also shows up clearly in the standards each one leans on. Cybersecurity programs typically align more closely with the NIST Cybersecurity Framework, while information security programs are usually built around ISO/IEC 27001. A full explanation of how these two standards map to each discipline is available here: cybersecurity and information security frameworks.

9 Key Differences Between Cyber Security and Information Security

Tables are great for a quick scan, but the difference between cybersecurity and information security really shows up in how the two disciplines behave day to day. Nine differences that matter in practice:

1. Scope of protection:Cyber security protects digital assets exclusively. Information security protects information in every form, a distinction that becomes real the first time an auditor asks how you’re securing printed patient records, not just your EHR database.

2. Threat model:Cyber security teams think in terms of attackers: nation-states, ransomware gangs, script kiddies. Information security teams think in terms of information lifecycle risk: creation, storage, transmission, archival, and destruction, whether or not an “attacker” is even involved.

3. Governing frameworks: Ask a cyber security engineer which framework they align to and you’ll usually hear NIST CSF 2.0. Ask an information security officer and you’ll usually hear ISO 27001 or SOC 2, frameworks built around governance and audit.

4. Physical world involvement: The cleanest test for difference between cyber security and information technology thinking versus information security thinking: if a badge reader on a data center door fails, that’s an information security incident. If a firewall rule fails, that’s a cyber security incident. Only one discipline owns both.

5. Job function and daily work: A cyber security analyst triages alerts, hunts threats, and patches vulnerabilities. An information security analyst spends more time on policy, risk assessments, vendor questionnaires, and audit prep, though many companies use both titles interchangeably (more on this below).

6. Relationship to IT: This is where difference between cyber security and information technology gets blurry. IT is the infrastructure, servers, laptops, networks. Cyber security defends that infrastructure. Information security governs the data it processes. IT vs cyber security is an infrastructure-versus-defense distinction; cyber security vs information security is a defense-versus-governance distinction.

7. Relationship to information systems: The difference between cybersecurity and information systems follows a similar pattern: information systems are the platforms (ERPs, databases, cloud environments) that store and process data; cyber security defends the systems; information security governs how the data inside them is classified, retained, and shared.

8. Compliance ownership: Cyber security teams get pulled into compliance mostly around technical controls (encryption standards, patch cadence). Information security teams typically own the compliance relationship, GDPR, HIPAA, PCI-DSS, ISO 27001, because those frameworks are about information governance first, technology second.

9. Career ceiling and specialization: Cyber security offers deep technical specialization (malware analysis, cloud security architecture, offensive security). Information security offers a path toward governance, risk, and compliance (GRC) leadership, and often a faster route into a CISO role, since it demands business and regulatory fluency, not just technical depth.

4 Additional 2026 Insights That Changed the Game

The difference between cyber security and information security keeps shifting, four 2026 developments have meaningfully redrawn the line.

1. AI-generated threats now belong to information security, not just cyber security: Deepfake voice cloning for CEO-fraud wire transfers, AI-written phishing lures, and synthetic-identity documents attack the trustworthiness of information itself, not just a network endpoint. That makes them an information security governance problem, verification policy, employee training, data-provenance controls, as much as a cyber security detection problem. Teams that still route “AI risk” exclusively to the SOC are missing half the exposure.

2. “Cyber information security” is emerging as a unified umbrella term: A growing number of 2026 job postings and vendor product names use “cyber information security” as shorthand for a converged function owning both digital defense and information governance under one leader. It isn’t standardized by NIST or ISO yet, but its rapid adoption signals that organizations want one accountable program, not two.

3. Hybrid work blurred physical and digital information risk permanently: A 2026-era employee might handle a confidential file on a laptop at a coffee shop, a printed contract at a co-working space, and a verbal client call from their kitchen, all in one afternoon, touching cyber security, physical information security, and procedural information security at once.

4. A 2026 case study: unified strategy at a regional hospital network: A mid-size U.S. hospital system disclosed in early 2026 that it contained a ransomware attempt within hours, not days, because its cyber security SOC and information security compliance team shared one incident-response runbook and one data-classification map. The SOC found the intrusion technically; the information security team immediately knew which patient records were affected and triggered HIPAA notification review in parallel rather than afterward, the practical payoff of one coordinated program instead of two.

The rise of AI has further sharpened the distinction. AI-generated attacks and shadow-AI risks now create problems that sit at the intersection of both disciplines. For a focused 2026 analysis of how these threats affect cybersecurity versus information security differently, see: AI threats in cybersecurity vs information security.

Is Data Security the Same as Cyber Security?

Is data security and cyber security the same? Not quite, and the distinction is useful. Data security is a subset of both cyber security and information security, it covers protecting data from corruption, theft, or unauthorized access through encryption, tokenization, masking, and backup/recovery. Cyber security is broader because it also covers the systems and networks around that data. Information security is broader still, covering data security plus physical and procedural protections. Think three concentric circles: information security is the outermost ring, cyber security sits inside it, and data security sits inside cyber security as one of its most important components.

Is Information Assurance the Same as Cyber Security?

Is information assurance the same as cyber security? No, information assurance (IA) is closer to a cousin of information security than a synonym for cyber security. IA, a term prominent in U.S. Department of Defense and government contexts, focuses on managing risk related to the use, processing, storage, and transmission of information, emphasizing the CIA triad plus authentication and non-repudiation. In government and defense circles, IA is often used as a near-synonym for information security, while cyber security stays narrower and digital-attack-focused. If a job title says “information assurance,” expect responsibilities resembling information security, with heavier emphasis on NIST’s Risk Management Framework (RMF).

Cyber Security vs Information Security Analyst: Roles, Salaries, and Career Paths

This is where the theory turns into a paycheck, so let’s get specific.

Information Security Analyst vs Cyber Security Analyst: Responsibilities

In most U.S. job markets, “information security analyst” and “cyber security analyst” are used almost interchangeably by recruiters. The BLS files both under one classification: Information Security Analysts (SOC 15-1212), professionals who plan, implement, upgrade, or monitor security measures for computer networks and information.

Real differences show up at the job-description level:

• Cyber security analyst postings lean toward SOC monitoring, incident response, malware analysis, and vulnerability management.
• Information security analyst postings lean toward risk assessments, policy development, audit support, and compliance documentation.

A resume heavier on SIEM tools fits “cyber security analyst” roles; one heavier on ISO 27001 audits fits “information security analyst” roles better, though many employers use the titles loosely.

Information Security vs Cybersecurity Salary

Because the BLS tracks both under one classification, national salary data is shared:

• Median annual wage: $129,180
• 10th percentile: $75,090
• 25th percentile: $97,810
• 75th percentile: $163,500
• 90th percentile: $199,850
• Projected job growth (2024–2034): 29%, with roughly 16,000 openings expected per year

Job-board aggregators paint a different picture for live postings: Indeed’s 2026 data puts average information security analyst base salary closer to $101,000–$102,000, “average” depends heavily on whether you’re reading a government wage survey or live job postings.

At the senior end, cyber security vs information security analyst pay converges into leadership compensation. Robert Half’s 2026 Technology Salary Guide puts CISO base salary between $195,000 and $420,000, midpoint around $307,500, with total compensation at large enterprises regularly reaching $350,000–$565,000, and a small number of Fortune 100 CISOs earning seven figures.

Can I Make $200,000 a Year in Cyber Security?

Yes, and it’s closer than ever. The BLS 90th-percentile figure of $199,850 shows experienced contributors in high-cost markets or regulated industries (finance, defense, healthcare) sit right at that threshold in base salary alone. Add a management title, a security architecture specialization, or a CISSP/CISM certification, and $200,000+ total compensation is realistic within 8–12 years.

Who Is Higher: CIO or CISO?

The CIO typically sits above or alongside the CISO, though this is shifting. Historically, CISOs reported into the CIO. In 2026, a growing share of large enterprises, finance, healthcare, and public companies subject to SEC disclosure rules, have the CISO reporting directly to the CEO or board, since security has outgrown being “just an IT problem.” CIO base salaries run roughly $170,000–$350,000+ (topping $600,000 at Fortune 500 companies), overlapping heavily with CISO comp bands, a sign the two roles are converging in seniority.

Which Is Better: Cybersecurity or Information Security?

There’s no universally correct answer to “which is better, cybersecurity or information security?”, it depends on what you’re optimizing for. Here’s a simple decision tree.

If you’re a career-changer or student, ask yourself:

1. Do you enjoy hands-on technical problem-solving (scripting, network troubleshooting, reverse-engineering malware)? → Cyber security will likely satisfy you more day-to-day.
2. Do you enjoy policy, negotiation, audits, and translating risk into business language? → Information security / GRC is likely the better fit.
3. Do you want the widest range of job openings short-term? → Apply to both; most employers don’t rigidly separate the titles at the analyst level.
4. Do you want the clearest path to a C-suite title? → Information security’s governance orientation maps more directly onto CISO responsibilities, though plenty of CISOs come up through cyber security.

If you’re a business leader deciding where to invest first, ask:

1. Is your biggest exposure digital (SaaS stack, remote workforce, e-commerce)? → Prioritize cyber security investment first.
2. Do you handle large volumes of physical records or regulated data (healthcare, legal, financial services)? → Prioritize information security governance first.
3. Are you preparing for a compliance certification (SOC 2, ISO 27001) or acquisition due diligence? → Information security has to lead, since auditors evaluate governance, not just tooling.

If you are deciding which path to pursue professionally, salary data and day-to-day responsibilities matter as much as definitions. A practical guide that helps you choose between the two career tracks based on skills, lifestyle, and long-term goals is available here: how to choose between cybersecurity and information security.

Bridging the Gap With a Unified Strategy

Here’s the uncomfortable truth most vendors won’t tell you: the difference between cyber security and information security causes real organizational damage when treated as a turf war instead of a division of labor. Teams that argue over which discipline “owns” a given risk waste time attackers are happy to exploit. Bridging the gap with a unified strategy means designing your security program around outcomes, not org-chart labels.

1. One risk register: Capture digital and non-digital threats to information in a single log, rather than two disconnected ones, one for “cyber,” one for “infosec.” Treating a misconfigured S3 bucket and an unshredded box of client files as the same underlying problem (unauthorized information exposure) stops teams arguing about jurisdiction and starts them prioritizing by actual business impact.

2. One accountable executive: Put the CISO over both functions, even if cyber security engineering and information security governance remain separate teams reporting up to that person. Gartner’s 2026 guidance on security organizational design recommends this “one throat to choke” model for mid-size and large enterprises, noting that fragmented ownership between IT security and compliance/GRC is a common root cause of slow incident response and repeated audit findings.

3. One mapped control framework: Run NIST CSF and ISO 27001 as a single mapped library instead of two parallel checklists. Most controls, encryption, access control, incident response planning, map cleanly across both, letting your team demonstrate compliance once and reuse the evidence across multiple audits, cutting audit fatigue.

4. One incident intake process: Treat cyber and information incidents identically at intake. A leaked customer database and a stolen laptop full of PDFs should trigger the same triage, notification, and legal review workflow, since they often carry identical regulatory consequences.

5. One AI risk assessment: Don’t let cyber security own “AI security” alone. Cyber security secures the models, APIs, and infrastructure; information security governs what data those tools may ingest, retain, and output, a growing exposure as employees paste confidential data into public AI assistants. A quarterly joint review should map every AI tool against the data it touches and assign ownership before a model reaches production, not after.

6. One integrated budget: When cyber security and information security compete for funding through separate proposals, executives end up comparing apples to oranges, a SIEM license versus a records-retention overhaul, with no shared metric for risk reduction. A unified strategy presents one integrated budget, prioritized by business risk rather than by which team wrote the request, which consistently produces faster board approval and fewer redundant tool purchases.

Do Companies Need Both InfoSec and Cybersecurity?

Do companies need both infosec and cybersecurity? For anything beyond the smallest business, yes, though how they staff for both scales with size.

Small businesses (under ~50 employees): You rarely need two separate teams, but you do need both functions covered, even if one generalist (a fractional CISO or outsourced MSSP) wears both hats. Skipping information security governance is costly, Verizon’s 2025 DBIR found ransomware present in 88% of SMB breaches versus 39% at large enterprises, largely because SMBs under-invest in governance (backups, access reviews, vendor vetting).

Mid-size companies (50–1,000 employees): This is typically where the functions formally separate, a SOC handling cyber security, a GRC/compliance function handling information security policy, usually still reporting to one security leader.

Enterprises (1,000+ employees or regulated industries): Both functions need dedicated teams, budgets, and reporting lines into the CISO and board. Public companies face an added reason: SEC disclosure rules require material incidents reported within four business days, impossible without an information security governance function that already knows what data lives where.

Benefits of Defaulting to “Information Security” Rather Than “Cyber Security”

A growing number of CISOs are intentionally defaulting to “information security” as the umbrella term across policy documents, job titles, and board reporting, even when the day-to-day work is mostly cyber-security-flavored. Real benefits of defaulting to “information security” rather than “cyber security”:

• It future-proofs policy language. A policy written around “information security” automatically covers new technology (IoT devices, AI agents) without a rewrite every time the landscape shifts.
• It closes physical-security gaps. Teams that only think in “cyber” terms often forget printed reports, whiteboards, and badge access, all of which show up in real breach investigations.
• It aligns with compliance language. ISO 27001, HIPAA, and most data-protection regulations are written around “information,” not “cyber,” reducing translation friction during audits.
• It reduces boardroom confusion. Non-technical executives understand “protecting our information” more intuitively than “protecting our cyber assets,” speeding up budget conversations.
• It signals maturity. Using “information security” as the umbrella, with “cyber security” as one workstream underneath, mirrors how mature GRC programs are actually structured, which auditors and acquirers notice.

None of this means “cyber security” is going away, quite the opposite. It simply means the umbrella term increasingly defaults to the broader, more durable concept.

Real-World Examples and 2026 Case Studies

Numbers make the difference between cyber security and information security concrete.

• Ransomware, by the numbers: Verizon’s 2025 DBIR found ransomware present in 44% of confirmed breaches, up from 32% the prior year, driven partly by a 34% jump in exploitation of unpatched vulnerabilities on edge devices and VPNs, a pure cyber security statistic.
• The human element hasn’t gone anywhere: The same DBIR found the human element a factor in roughly 60% of breaches, phishing, credential misuse, social engineering, which straddles both disciplines: cyber security builds the technical guardrails (MFA, email filtering); information security owns the awareness training that reduces how often employees fall for the attempt.
• Third-party risk doubled: Breaches involving third parties rose sharply in the 2025 DBIR, underscoring why vendor risk management, a core information security function, not a cyber security one, is now a board-level priority.
• Cost keeps climbing: Independent research places average ransomware-related breach cost north of $5 million, with U.S. breach costs overall averaging above $10 million, reflecting the combined failure of technical controls (cyber security) and governance controls (information security).
• A recognizable breach timeline: Most 2025–2026 ransomware incidents follow a pattern: initial access via phished credential or unpatched VPN (cyber security failure), lateral movement via excessive privileges (a shared gap), data exfiltration (information security scope), and regulatory notification triggered by exactly what information was exposed (an information security governance question).

For a printable reference, see our Cybersecurity vs Information Security PDF guide.

Frequently Asked Questions FAQ’s

Difference between cyber security and information security, what’s the one-line answer?

Information security protects all information in any form; cyber security protects digital systems and data specifically, and is a subset of information security.

Is data security and cyber security the same?

No. Data security protects data itself (encryption, backups, access controls) and sits inside both, as a supporting discipline.

Is information assurance the same as cyber security?

Not exactly. It’s a broader risk-management concept related to information security, common in government and defense; cyber security stays narrower and digital-specific.

What is the definition of information security?

NIST defines it as protecting information and systems from unauthorized access, use, disclosure, disruption, modification, or destruction, to ensure confidentiality, integrity, and availability, regardless of medium.

What is a information security program supposed to include?

Data classification, access control policy, incident response planning, vendor risk management, employee training, and alignment to a framework like ISO 27001.

Cybersecurity or cyber security, which spelling is correct?

Both are accepted. “Cybersecurity” dominates U.S. tech writing; “cyber security” is more common in government and Commonwealth usage.

IT vs cyber security, how are they different?

IT builds and maintains infrastructure; cyber security defends it from attack.

Information security vs cybersecurity, is one a career track and the other a job title?

Both function as both. “Information security” more often labels governance roles; “cyber security” more often labels technical, defense-focused roles.

Cybersecurity vs computer security, is there a difference?

Yes, subtly. Computer security is an older, narrower term for individual computers; cyber security expanded that to networks, cloud, and cyberspace broadly.

Information security analyst vs cyber security analyst, which pays more?

Both fall under the same BLS classification (SOC 15-1212), median $129,180 (updated May 2025 BLS data). Pay differences come from specialization and seniority, not the title.

Difference between cybersecurity and information security in one sentence for a resume?

“Managed [information security / cyber security] programs covering [governance and risk / technical threat detection] for a [industry] organization.”

Difference between cybersecurity and IT security, aren’t they the same thing?

“IT security” is a near-synonym for cyber security. Both stay digital; information security also covers physical and procedural protections.

Information security vs cybersecurity salary, what should I expect at each level?

Entry-level: $75,000–$98,000. Mid-career: $98,000–$130,000. Senior/lead: $130,000–$200,000+. CISO-level: $195,000–$420,000+ base.

Cybersecurity vs information security analyst, which should I choose as a first job?

Pick cyber security for technical troubleshooting; pick information security for writing, policy, and stakeholder communication. Both lead to the same senior ceiling.

Difference between cyber security and information technology, how do I explain it to a non-technical person?

IT is “the computers and the network.” Cyber security is “keeping bad actors out.” Information security is “keeping our information safe no matter where it lives.”

Difference between cybersecurity and information systems, same question, different angle?

Information systems are platforms (ERP, CRM, databases) storing data. Cyber security defends those systems; information security governs how the data inside is classified and retained.

Which is better, cybersecurity or information security?

Neither is objectively better, it depends on your interests and your organization’s risk profile.

What is the benefit of bridging the gap with a unified strategy?

One accountable executive, one risk register, and one mapped control framework reduces audit fatigue and speeds incident response.

What are the benefits of defaulting to “information security” rather than “cyber security”?

Future-proofed policy language, better physical-risk coverage, closer compliance alignment, and clearer boardroom communication.

Is information security and cyber security the same thing? / Are cyber security and information security the same thing?

No. Cyber security is a subset of the broader information security discipline; most organizations need both.

What is cyber security?

Protecting digital systems, networks, applications, and data from unauthorized access, attack, or damage.

What is information security?

Protecting the confidentiality, integrity, and availability of information in any form, digital, physical, or verbal.

Examples of cyber security?

Firewalls, endpoint detection and response, multi-factor authentication, penetration testing, and SOC monitoring.

Examples of information security?

Data classification policy, physical access controls, records retention, vendor risk assessments, and employee training.

Why is information security important?

Because much of real-world data loss involves non-digital failures, physical theft, insider misuse, vendor mishandling, that a purely “cyber” program would never catch.

Information security jobs, what does the market look like in 2026?

Strong: BLS projects 29% employment growth for information security analysts through 2034, with roughly 16,000 openings annually.

Information security course, do I need a degree, or will a certification work?

Both paths work. A degree helps at larger employers; certifications (Security+, CySA+, CISSP, CISM) plus hands-on experience are often sufficient for analyst roles.

Can I make $200,000 a year in cyber security?

Yes, the BLS 90th percentile is now $199,850, typically at senior individual-contributor or management level with a strong certification and 8+ years of experience.

Who is higher, CIO or CISO?

Traditionally the CIO, with the CISO reporting into them, though a growing share of large and public companies now have the CISO report directly to the CEO or board.

Do companies need both infosec and cybersecurity?

Yes, functionally, small businesses often combine both into one role, while mid-size and large organizations separate them into distinct teams under one leader.

Is cybersecurity part of information security?

Yes. Cyber security is the digitally focused subset of the broader information security discipline.

Can a single software tool secure both cybersecurity and information security?

No single tool covers both completely, since information security includes non-digital governance elements no software manages end-to-end. Integrated GRC platforms come closest.

Is information security a good career?

Yes, strong salary growth, high job security, a clear path to executive leadership, and a 29% projected growth rate through 2034.

Conclusion: One Discipline, Two Essential Halves

The difference between cyber security and information security ultimately comes down to scope: information security is the umbrella discipline protecting all information, and cyber security is the specialized function protecting the digital slice of it. Neither replaces the other, the organizations that perform best in 2026 stop debating which term to use and build a single, unified strategy with one executive, one risk register, and one control framework over both.

Sources & References

1. NIST: Cybersecurity Framework 2.0
2. NIST CSRC: Glossary (source for the information security / CIA-triad definition)
3. ISO/IEC 27001
4. BLS: Occupational Outlook Handbook: Information Security Analysts (median wage, growth rate, openings)
5. BLS: OEWS 15-1212 (percentile wage breakdown)
6. Gartner: Security & Risk Management Summit 2026
7. Verizon: 2025 DBIR
8. IBM/Ponemon: Cost of a Data Breach Report 2025
9. Indeed: Information Security Analyst Salaries
10. CISA