Yep the problem is that some of the well known certs are bad, not that the concept of IT security certifications are bad. I've been in IT/Infosec for 17 years

Yep the problem is that some of the well known certs are bad, not that the concept of IT security certifications are bad. I've been in IT/Infosec for 17 years now. I have certs that I literally maintain as a HR/sales checkbox (e.g. CISSP) and certs that make me think every time I need to refresh them (e.g. CREST CCT). It's possible to have good IT sec. certs.