Is it just my perception, or is getting into security a bit of a pain? It seems like there's a lot of domain specific knowledge (I.e. stuff you won't know/remem

Is it just my perception, or is getting into security a bit of a pain? It seems like there's a lot of domain specific knowledge (I.e. stuff you won't know/remember coming straight out of a regular math/cs degree) and practicing/learning isn't necessarily free either (e.g. buying routers/switches/firewalls etc to set up a lab)