Retraining in cyber security?

[ImplementingTheDennisSystem]

I'm putting this in 'Chat' for a broader audience...
DH has worked for a tiny local company for 15 years in a largely administrative role.
He's not had a pay rise or any progression in 15 years and there is no 'career path' associated with his line of work.
He's decided he now needs an exit strategy.
He likes the idea of gaining CompTIA cyber security qualifications. He has a Business Studies degree and a natural interest in, and aptitude for, IT.
Can anyone in the industry confirm if this might be a sensible route to go down? Is he likely to qualify at something and find work, despite not having any relevant work experience?

He would be starting at the very bottom, having an aptitude for IT probably wouldn't be enough. He would need to be able to understand Firewalls, proxies, antivirus etc. Be aware of penetration testing, how to identify and mitigate vulnerabilities in the network etc and also patch management. Whilst qualifications are great, in IT experience counts for a lot. A lot tend to start on a Service Desk and make their way up to 3rd line support and/or Security. He should also expect to do on call, on a rota bases or have to work shifts depending on the organisation. Saying all that it is a good area to work in, the demand is increasing more and more and salary potential is good. This also means there are a lot pf people interested in this field and a lot of competition.

Is he interested in coding? Lots of free courses to try on line. Growing area

My son is in cyber but intending to move out of it asap, he has a degree in programming. Anyone his company have taken on in the last year/18 months are graduates or ex services who trained in or have extensive experience in the field.

There is a big demand but there's a lot more to it than antivirus and firewalls, I don't think I've ever actually heard him uttering those words outside of a domestic situation.

It depends on what he wants. It's extremely repetitive and surprisingly mind numbingly boring. He'd be best to get in contact with recruiters or startups and ask them what chance they think he's got. It maybe that tech support might be more up his street and more achievable in the short term as a foot in the door and he can work his way into security if he still wants to.

I was using firewalls and anti virus as an example of the basic IT knowledge needed. Cyber security is very complex.