Why I Switched Bootcamps: A Lesson in Learning What You Actually Need

I mentioned in my last post that I was diving into a cybersecurity bootcamp — and left out one detail on purpose: this isn’t the first one I started.

Time to fill in that gap.

Starting With the End in Mind

Before I picked any program, I did what ten years of legal training and finance experience trained me to do: research first, commit second. I already knew where I wanted to end up — the GRC pathway, governance, risk, and compliance — so I worked backward from there. What does a GRC professional actually need to know? What skills close the gap between “lawyer who understands risk” and “cybersecurity professional who understands risk”?

With that list in hand, I picked a bootcamp and got started.

Where the First One Fell Short

The problem showed up early. The program was teaching technical fundamentals, but without building the foundation underneath them — the why behind the how. I kept finding myself reverse-engineering the reasoning behind a task just to understand what I was actually doing and why it mattered.

It also felt isolating. Less like a guided program, more like a single-learner journey I was mostly navigating on my own. And an expensive one at that.

I stuck with it. By Module 3, I’d turned in two assignments and scored well on both. On paper, things were going fine. But “going fine” and “building what I actually need” aren’t the same thing, and I knew it.

So I stepped back.

Comparing Syllabuses (Because of Course I Did)

I went back into research mode — pulling up syllabuses, comparing what each program actually covered week by week, and mapping them against the GRC skill list I’d built at the start. Not vibes. A side-by-side comparison, the same way I’d have reviewed competing term sheets.

The Coursera Google Cybersecurity Certificate came out on top, and switching to it was the right call. I’m now learning the actual ABCs of cybersecurity, one lesson at a time, and genuinely enjoying the climb.

The Lawyer Habit That Won’t Quit

Here’s something about me that hasn’t changed no matter what field I’m in: I love research. It’s the one part of legal training that transfers over without needing to be “translated” into tech terms.

So alongside the program, I’ve been going deeper on my own — reading into frameworks like NIST CSF and NIST SP 800 and Sarbanes-Oxley (SOX), building out my understanding beyond what any single course covers. It’s slower, but it’s sticking, and it’s exactly the kind of self-directed research that got me excited about this field in the first place.

One of those side reads is where the rest of this post comes from.

Something That Stuck With Me

I came across a formula that instantly made sense to me — probably because it’s basically risk analysis in disguise:

Asset + Threat + Vulnerability = Risk

An asset is anything worth protecting. A threat is anything capable of causing harm. A vulnerability is the weak point a threat could exploit. Put them together, and you get risk — the real possibility that something valuable gets hurt because a weakness met an opportunity.

I’ve spent a decade thinking about risk in legal and financial terms. Seeing it distilled into a formula this clean was one of those moments where cybersecurity stopped feeling foreign and started feeling like a new dialect of a language I already speak.

And here’s why this particular formula feels so timely: right now, GRC coverage is dominated by one topic — AI governance. Industry reports are flagging AI-related vulnerabilities as the fastest-growing cyber risk organizations are dealing with, and the push is for real accountability structures and risk assessments built specifically around how companies use AI. Run that through the formula and it clicks instantly: AI is simultaneously becoming a valuable asset worth protecting, a new threat route, and a source of fresh vulnerabilities — data integrity issues, model security gaps, bias baked into outputs. Same formula I just learned. Brand new territory to apply it to.

Here’s the part that actually made me stop and smile: I’ve seen this movie before. In finance, there’s a pattern that repeats itself almost predictably — whatever is new and unregulated gets treated as pure risk, right up until it isn’t. Derivatives were suspect until frameworks like Dodd-Frank built guardrails around them. Fintech partnerships were flagged as exposures to manage until they became core infrastructure with their own playbook. Crypto is still somewhere in the middle of that same arc right now.

The lesson underneath all of it: risk was never really about the thing itself. It’s about the absence of a framework around the thing. Once governance catches up, the “risk” doesn’t vanish — it gets absorbed into normal operations. AI is just the current name in that same story.

That’s the part of GRC that excites me most: the underlying logic of risk (asset, threat, vulnerability) is stable — but the frameworks built on top of that logic absolutely evolve, and often have to evolve specifically because the what keeps changing.

I’m not an expert yet — just an observer, comparing what I’m learning now to what I’ve already lived through. I’ll be tracking more of these as the program continues. More on that in the next post.