Of course you don't need to know how to write shellcode, or have in-depth knowledge of anti-debugger reversing tricks, to write a very useful and robust securit

Of course you don't need to know how to write shellcode, or have in-depth knowledge of anti-debugger reversing tricks, to write a very useful and robust security policy for an organisation, or manage a global incident response team. I wouldn't be so quick to dismiss the degree just because it doesn't teach 'practical' security. It's the same story with Computer Science degrees, which don't teach about source control or agile software methodologies, since these 'practical' subjects aren't really anything to do with CS.