What InfoSec Taiwan 2026 Showed Me About the Gap Between Students and Industry

Opening: Not an Event Recap, But a Reason to Think Again

After attending InfoSec Taiwan 2026, I originally thought I would write a standard event recap.

I expected to list the booths I visited, the sessions I heard, the companies I encountered, and a few technical keywords that stood out. But after I came back, what stayed with me was not a single talk or a single exhibition area. It was a very clear sense of distance.

That distance was not about who was better. It was not about students being lazy, or companies being unwilling to understand students.

It felt more like both sides were looking at the same cybersecurity field while asking very different questions.

Students often ask, “What can I build?”

Companies more often ask, “What real problem does this solve?”

Both questions matter, but they lead people in very different directions. That is the observation I most wanted to write down after InfoSec Taiwan 2026.

What I Saw in Student Research

From a student’s perspective, cybersecurity is a field that easily pulls people toward technique.

We encounter CTF, practice Web, Crypto, Reverse, Pwn, and Forensics, and use competitions to prove our ability. CTF is attractive because the goal is clear, the feedback is direct, and once a challenge is solved, you can feel that you have taken another step forward.

Beyond CTF, many student projects in recent years have also centered on AI.

For example, students may use AI for attack detection, phishing email classification, malware classification, abnormal traffic analysis, or integrate large language models into security tools to make a system appear more intelligent and automated. These directions are not bad. Many of them have real potential.

In innovation showcases, science fairs, project presentations, and competitions, I also often see topics around IoT, offensive and defensive techniques, smart monitoring, vulnerability scanning, and automated testing. These projects are usually easy to demonstrate because they have visuals, workflows, technical highlights, and can quickly show an audience what the system does.

I am very familiar with this way of thinking.

As a student, it is natural to start with “what technology do I know?” and then expand that into “what project can I build?” If I recently learned AI, I might want to put AI into security. If I recently practiced offensive security, I might want to build an attack detection or defense platform. If I have touched IoT, I might want to connect device security with cybersecurity.

There is effort behind these directions, and they all have learning value.

But at the exhibition, I began to feel that the topics students are familiar with and the problems companies are dealing with are not always on the same plane.

What I Saw in Enterprise Needs

At InfoSec Taiwan 2026, many companies did not start their security conversations with a polished technical demo. They started from risk, responsibility, operations, and compliance.

Financial security was one obvious example.

The financial sector is not only asking whether a single system has a vulnerability. It has to think about transaction security, identity verification, fraud detection, data protection, supply chain risk, audit requirements, and the pressure of keeping operations available. For companies, Cybersecurity is not an extra feature. It is the basis for whether a service can be trusted.

SOC was another direction that came up often.

Companies need people who can read logs, analyze alerts, judge incident severity, trace attack paths, and make reasonable decisions within limited time. This is very different from CTF. CTF problems usually have a defined answer, but real incidents may have incomplete data, false positives, and attackers who do not follow the path imagined by a challenge designer.

Incident Response is similar.

Companies care about practical questions: when an attack really happens, how do we determine the scope? Should a host be isolated? Should the incident be reported? How should evidence be preserved? How should service be restored? How do we write a post-incident report that technical teams, management, legal teams, and customers can all understand?

These questions are not always easy to turn into a flashy demo, but they are very real.

Beyond that, compliance, Zero Trust, AI Blue Team work, and post-quantum cryptography were all themes I noticed in enterprise needs. These directions may not produce dramatic results in a short time, but they all point to the same thing: the security capabilities companies need are often not single-point techniques, but capabilities that can operate inside real environments.

Where Is the Gap?

I do not think the gap between students and companies is simply a lack of technical skill.

Many students are strong.

Some can go very deep in CTF. Some can research vulnerabilities on their own. Some can write tools. Some can integrate AI models into systems. Some can build complete projects in a short period of time.

The real difference may be problem framing.

When students build projects, they often start from capability:

I can write software, so I will build a platform.

I know AI, so I will build an AI detection system.

I know offensive and defensive techniques, so I will build an attack simulation tool.

I know IoT, so I will build a smart device security solution.

This way of thinking is natural, because students need work that proves what they have learned, and they need competitions or showcases where judges can see the result.

Companies usually start somewhere else.

They are less likely to ask, “What new technology did you use?” They care more about questions like:

Can this reduce risk?

Can this help incidents be detected faster?

Can this reduce false positives?

Can this satisfy audit requirements?

Can people on site actually use it?

Can this help the organization make decisions during an incident?

So the gap is not that students do not understand technology, or that companies only care about management. The gap is closer to this: students often start from what technology can do, while companies often start from what the field needs solved.

Why Companies Care About Deployable Capability

I used to think that if the technology was strong enough, it should be able to solve many problems.

Now I gradually understand that companies care about whether something can be deployed not because they do not value technology, but because real environments have too many constraints.

A system cannot merely run.

It must be maintainable, transferable, integrated with existing processes, resilient to false positives and false negatives, and explainable under regulatory and management requirements.

For example, in a student project, an AI detection system may look convincing as long as the accuracy is decent. Inside an enterprise environment, the questions become much more complex.

Where does the data come from?

Why did the model decide this was abnormal?

If there are too many false positives, will SOC analysts become even more overloaded?

If the model is wrong, how is responsibility defined?

If an attacker intentionally evades the model, can the system continue to adapt?

These questions may not be more exciting than the technology itself, but they decide whether a tool can actually be used.

This is also what companies seem to value in security talent. They need people who can build features, but also people who understand environments, risks, process, and communication.

From SOC and Incident Response to AI Blue Team

This time, SOC and Incident Response left a particularly strong impression on me.

In the past, when I studied cybersecurity, I often focused on attack techniques and vulnerabilities. They are direct, and they make it easy to feel that you are getting stronger.

But in an enterprise Blue Team setting, the work is often less about chasing the most elegant exploit and more about finding the signal that matters in a large amount of noise.

SOC analysts face continuous logs, alerts, endpoint events, network traffic, and user behavior. Incident responders face uncertainty. Under time pressure, they have to determine which systems are affected, what data may have leaked, and which services should be paused or restored.

AI Blue Team work makes this even more complex.

AI can help organize alerts, summarize incidents, build correlations, and support judgment, but it can also introduce new risks. Models can misclassify. Prompts can be manipulated. Data sources may be unclean. Automated response may cause greater impact if a wrong judgment is made.

So the AI security capability companies need is not simply “put AI into the tool.”

What matters more is understanding where AI fits in Blue Team work, where it does not fit, and how to make it an assistant instead of a new source of risk.

This changed how I think about AI security projects.

Before, I might first ask, “Is this model accurate?”

Now I am more likely to ask, “If this model is placed into a real SOC workflow, whose work becomes clearer, and what new risks does it introduce?”

Post-Quantum Cryptography: Companies Are Thinking About the Next Decade

Post-quantum cryptography was another direction that stayed with me.

For students, post-quantum cryptography may feel far away. It does not produce immediate results like a Web vulnerability, and it is not as easy to demonstrate visually as an AI project. It requires an understanding of cryptography, standardization, system migration, and long-term risk planning.

But from a company’s perspective, it is not far away.

Data that companies store today may still be valuable ten years from now. Financial transactions, identity data, trade secrets, and data related to government or critical infrastructure do not become permanently safe just because they are safe today.

If quantum computing capabilities mature in the future, data that is encrypted or intercepted today may be decrypted many years later. That risk cannot wait until quantum computers are mature. Organizations need to inventory assets, evaluate cryptographic use cases, and plan migration paths ahead of time.

This showed me another difference between companies and students.

Student projects often need visible results within one semester or one competition.

Enterprise security has to think three years, five years, or even ten years ahead.

Neither side is inherently better. The time scale is simply different.

My Reflection

My biggest reflection from this event is that I cannot keep judging a project’s value only by whether the technology is easy to demonstrate.

Demonstration matters because it lets people see the result and trains me to explain my ideas clearly. But if a project stops at demonstration, it can easily become something that looks complete while nobody knows where it should actually be used.

I also started rethinking the questions I ask myself.

I used to ask, “What can I build?”

That question is not wrong. For a student, being able to build something matters because it means knowledge has been turned into hands-on work.

But from now on, I want to ask another question more often:

“What real problem does this solve?”

If I build an AI security project, I should not only ask whether the model can run. I should ask whether it helps analysts understand incidents faster.

If I build an IoT security project, I should not only ask whether I can attack or defend a device. I should ask what risk that device carries in a real environment.

If I build a Blue Team tool, I should not only ask whether the feature is complete. I should ask whether it can fit into SOC, Incident Response, or audit workflows.

These questions are harder, and they do not always produce polished results quickly.

But they are closer to the real world.

Conclusion

InfoSec Taiwan 2026 was not just an exhibition or event experience for me.

It felt more like a reminder that there is a real distance between how students learn cybersecurity and what companies need from cybersecurity.

That distance is not necessarily a bad thing.

Students need to explore, experiment, and build capability through CTF, AI projects, innovation showcases, IoT, offensive and defensive techniques, and competition-oriented projects. Companies also need to face real-world risk through financial security, SOC, Incident Response, compliance, Zero Trust, AI Blue Team work, and post-quantum cryptography.

What matters is whether we can recognize that we are asking different questions.

Students often ask, “What can I build?”

Companies care more about, “What real problem does this solve?”

I hope my future projects will not only demonstrate technology, but also respond to real-world needs.

Because Cybersecurity is not just about building the technology.

It is also about knowing who that technology is supposed to help, and what problem it is supposed to solve.