If I were an employer, and I had to choose between a college graduate who knows nothing about the job yet and a cycrim who just got released from prison, but has no degree, then I'd rather pick the cycrim over the graduate, because at least the cycrim actually has provable experience in the field, and thorough knowledge on cyber security.