Security testing in the US: what the numbers say, and how to train for it

Security work is moving closer to testing. Breaches are costly, attackers often get in through known weaknesses, and US employers keep hiring in the field. This article looks at three public sources, the OWASP Top 10, Verizon, IBM and the US Bureau of Labor Statistics, and at what a tester can learn from them.

One rule before anything else: security testing is done only on systems you are authorised to test, with the owner's written permission. Everything below, including the training, rests on that rule.

What Verizon's 2026 report says about how attackers get in

The Verizon Data Breach Investigations Report 2026 covers incidents from 1 November 2024 to 31 October 2025. Its headline: exploiting a software vulnerability is now the leading way into a network, at 31% of breaches, ahead of stolen credentials. Help Net Security reports that this is the first time in the report's 19 years that credential theft has lost the top spot, and that only 26% of the vulnerabilities on CISA's "known exploited" list had been fully fixed across the 13,000 organisations polled, down from 38% the year before.

For a tester, the message is simple. A fifth to a third of breaches start with a flaw that someone could have found earlier. Finding it earlier is the job.

What a breach costs: IBM's 2026 report

IBM's Cost of a Data Breach Report 2026 puts the worldwide average at $4.99 million, up 12% and a record. According to a summary by the law firm Baker Donelson (report published 30 July 2026), the US average is $11.5 million per incident, up 11%, more than double the global figure. Treat averages with care: a small company is unlikely to see a bill that size, and the mix of cases changes from year to year.

The job market: what the BLS shows

The US Bureau of Labor Statistics tracks information security analysts. Its page, last modified on 27 August 2026, shows about 192,900 jobs in 2025, a median pay of $129,180 per year (May 2025), and projected growth of 21% from 2025 to 2035.

A caution: "information security analyst" is not the same job as "security tester", and these figures say nothing about what a new graduate of any course would earn or whether they would be hired. They show where the demand for security skills is heading, no more.

The OWASP Top 10: the 2025 edition

OWASP maintains the standard list of web application risks. The current version is the 2025 edition:

1. A01 Broken Access Control
2. A02 Security Misconfiguration
3. A03 Software Supply Chain Failures
4. A04 Cryptographic Failures
5. A05 Injection
6. A06 Insecure Design
7. A07 Authentication Failures
8. A08 Software or Data Integrity Failures
9. A09 Security Logging and Alerting Failures
10. A10 Mishandling of Exceptional Conditions

Software supply chain failures and the mishandling of exceptional conditions are the new ideas compared with the previous edition. OWASP notes that "Injection" runs from cross-site scripting (frequent, usually lower impact) to SQL injection (rarer, high impact).

Reading the list as a tester

The list is not a checklist to tick off once. It tells you where to look first. OWASP says that on average 3.73% of the applications tested had at least one of the 40 weaknesses grouped under Broken Access Control, which stays at number one. Security Misconfiguration moved up from fifth place in 2021 to second, because more of an application's behaviour now lives in configuration. Software Supply Chain Failures has the fewest occurrences in OWASP's data, but the highest average exploit and impact scores from known vulnerabilities, and OWASP believes testing has not yet caught up in this area.

For a QA team this has a practical meaning. Access control and configuration are checked with ordinary test techniques: roles, permissions, environments, default settings. You do not need to be an attacker to start. You need a method, a clear scope and the habit of asking "what if this user should not see this?"

Putting the figures together

Three different sources point the same way. Verizon shows that known weaknesses are a main way in. IBM shows that a breach is expensive, especially in the United States. The BLS shows that employers keep hiring for security roles. None of them proves that a given course leads to a given job, and we make no such promise: they explain why more testers are asking whether security should be part of their skills.

What a security tester actually does

A security tester asks, on an authorised environment, the questions an attacker would ask. Can one user open another user's data by changing an ID in the URL? Does a form field accept code? Does an error message say too much? Are sessions and passwords well protected?

• Turn a risk list into test cases, starting from the OWASP Top 10.
• Test inputs: SQL injection, XSS, CSRF.
• Write a clear finding: what was tested, what was found, how to reproduce it, what the risk is.
• Stay in scope: defined perimeter, written authorisation, a test environment.

The method, preparing, executing and reporting, is the same as in any testing job. We do not claim a course is enough to make a specialist: hands-on experience matters just as much.

The Sec Test specialisation (Security Tester)

Here is what the specialisation page says, and nothing more:

• Content: OWASP Top 10, SQL injection, XSS and CSRF.
• Length: 399 hours over 3 months.
• Format: 100% online, with mentoring included.
• Access: 6-month platform, 24-month replays.
• Next session: December; the exact date is confirmed with an adviser.

Price: €1,500 launch price for individuals (1 to 4 interest-free instalments), €7,500 for companies. Prerequisites and validation terms are confirmed with ADC.

Certification: for the specialisations, certifications are still to be confirmed with ADC, so we promise none for this track.

Language: our courses are taught in French and are fully online. Please check this fits you before you enrol.

Funding: ADC is not yet eligible for French public training funding (CPF, France Travail). Instalments and employer funding are available: see the financing page.

Frequently asked questions

Written with AI assistance and signed by Oussama Belakhdar. Figures come from the sources above, read on 19 October 2026. This is general information, not legal or career advice.