BLOG

Cloud security is no longer a specialized topic; it is foundational to how organizations operate. Yet cloud security education often reflects legacy assumptions rooted in static infrastructure, defined perimeters, and clearly separated responsibilities. As a result, students may leave the classroom with a strong grasp of concepts and frameworks but limited experience applying them in real-world contexts. 

This gap is especially apparent in areas such as identity management, cloud misconfigurations, and shared responsibility, where practical judgment is often as important as technical knowledge. Without both, mistakes can lead directly to data exposure or system compromise.  

The challenge for educators is not just helping students understand cloud security but preparing them to apply it effectively in modern environments. That intersection between industry practice and education is where Andy Igonor has spent much of his career. 

As a cybersecurity practitioner, consultant, and educator, Igonor has worked with organizations securing cloud and AI workloads while also teaching students preparing to enter the field. Drawing on both perspectives, he wrote Fundamentals of Cloud Security to better align how cloud security is taught with how it actually works in practice. 

“As organizations move from on‑premise environments to the cloud, it fundamentally changes everything—from architecture to governance to how we think about responsibility,” he explains. 

That same shift, he argues, needs to be reflected more deliberately in how cloud security is taught. 

What’s Missing from How Cloud Security Is Typically Taught 

One of the most common challenges Igonor sees is that cloud security is often approached as an extension of traditional network security. While the vocabulary may change, the underlying assumptions often do not. 

“Too many programs still treat cloud security as traditional security with a different name,” he says. “Students jump straight into controls without understanding cloud architecture, service models, or what migration actually means.” 

This method creates gaps that show up quickly once students encounter real cloud environments. Without a solid understanding of concepts like shared responsibility, identity-centric security, and cloud service models, security decisions feel arbitrary rather than intentional. 

When Igonor began writing Fundamentals of Cloud Security, he intentionally started with explaining cloud computing concepts, architecture, and migration readiness; all topics before security operations. That foundation, he argues, is what allows security topics to make sense later. 

“If a student truly understands the shared responsibility model,” he notes, “that completely changes how they think about security obligations.” 

For educators, this approach offers a way to move beyond reactive curriculum design and toward a more structured, intentional progression. 

Teaching Cloud Security as a Lifecycle 

Another challenge in cloud security education is fragmentation. Identity, threat detection, incident response, and compliance are often introduced as separate topics, leaving students to piece together how they relate, and leaving educators without a clear throughline for how one decision impacts the next. In practice, that disconnect can lead to graduates who know individual concepts but struggle to apply them in real environments. 

In Fundamentals of Cloud Security, Igonor uses the NIST Cybersecurity Framework (CSF) as a structure for thinking rather than a reference point.  A shared framework gives students the lens they need, helping them connect technical actions to governance, risk, and outcomes. 

“The NIST CSF provides a shared professional language that bridges academia and industry,” he explains. “I didn’t want it to live in an appendix. I wanted students to think with it.” 

By aligning cloud security operations with the Protect and Detect functions, and governance and response activities with Identify, Respond, and Recover, students begin to understand security as a lifecycle. This framing helps them see how decisions at one stage influence outcomes at another. 

For instructors, this structure also supports standards-based course design, making it easier to align learning objectives with workforce expectations and certifications without teaching to the test. 

Why Real‑World Scenarios Matter More Than Ever 

Cloud security decisions rarely happen under ideal conditions, which is why Igonor places significant emphasis on scenario-based learning in Fundamentals of Cloud Security. 

“Scenarios are how abstract concepts become internalized judgment,” he says. 

Rather than simply reading about cloud migration or incident response, students are asked to work through realistic situations: deciding what workloads move first, how shared responsibility shifts during migration, or how to respond to a breach while balancing regulatory requirements, timelines, and limited resources. 

“That’s when students have the lightbulb moment,” Igonor explains. “That’s when they say, ‘Okay, this is what this actually looks like in practice.’” 

For educators, these scenarios create space for discussion, debate, and applied analysis, which helps students move from memorization to decision making. 

Cybersecurity Skills Programs Should Be Prioritizing Today 

Preparing students for cloud security careers isn’t about training them for a single role. Igonor emphasizes that cloud security work spans a wide range of responsibilities and that programs should reflect this reality. 

“The easiest way to think about skills is through the lifecycle,” he says. “Identify, detect, protect, govern—each one maps to a different set of competencies.” 

Students may ultimately specialize in security operations, governance and risk, architecture, or advisory roles, but they still need awareness across the full spectrum to collaborate effectively.  

“Nobody’s going to be an expert at everything,” Igonor notes. “But students need to understand how all the pieces fit together.” Fundamentals of Cloud Security emphasizes the need for cross‑functional fluency alongside technical depth. 

That understanding allows graduates to enter the workforce at different levels and grow over time, rather than being locked into narrow, tool-specific roles. 

How AI Is Reshaping Cloud Security Roles 

Layered on top of the changes in cybersecurity over the last decade is the growth of AI. Unfortunately, as Igonor notes, AI is not just helpful for tooling, but for how attackers and defenders operate. 

“AI has expanded the attack surface,” he says. “It’s made sophisticated attacks easier and faster.” 

From prompt injection and data exfiltration to automated exploit discovery, AI is changing both the nature of threats and the expectations of security teams. At the same time, many security operations are becoming increasingly AI augmented. 

“That’s shifting roles from execution toward oversight, interpretation, and governance,” Igonor explains. 

Because tools are constantly evolving, cloud security education needs to emphasize skills that remain relevant over time, such as systems thinking, resilience, and governance. Fundamentals of Cloud Security is structured around principles, frameworks, and real-world decision making, rather than just technologies. By grounding cloud security in foundational concepts, aligning it with the NIST CSF, incorporating realistic scenarios, and addressing emerging issues like AI governance, the text acts as a practical bridge between theory and practice. 

As Igonor puts it, “Security is fluid. The most important thing we can give students is a way to think.”