The Ongoing Cybersecurity Skills Shortage

Introduction

The increasing shortage of cybersecurity professionals is a major challenge for organisations worldwide. It is driven by a combination of factors, including a lack of training and education programmes, the high demand for cybersecurity professionals across industries and the increasing frequency and sophistication of cyber threats. However, there simply aren’t enough qualified professionals to fill all of the available positions.

Without the right skills onsite, organisations do not have the foresight to undertake cyber security and deploy the necessary infrastructure to stop attacks. While technology teams are often focused on mitigating cyber threats, those using the technology aren’t always adept in deploying effective security practices.

Latest cybersecurity skills research

The cybersecurity skills crisis continues on a downward trend. It has impacted 57% of organisations, as revealed in the global study of cybersecurity professionals by the Information Systems Security Association (ISSA) and industry analyst firm Enterprise Strategy Group (ESG). The research report, The Life and Times of Cybersecurity Professionals 2021, surveyed 489 cybersecurity professionals. The top ramifications of the skills shortage demonstrate:

• An increasing workload for the cybersecurity team (62%)
• Unfilled open job requisitions (38%)
• High burnout among staff (38%).

In addition, 95% of respondents state the cybersecurity skills shortage and its associated impacts have not improved over the past few years: 44% say it has actually got worse.

Cybersecurity Workforce Study 2021

An (ISC)² Cybersecurity Workforce Study 2021 collected survey data from 4,753 cybersecurity professionals working with SMEs and large organisations globally. In 2021, the study estimated that there were 4.19 million cybersecurity professionals worldwide, which is an increase of more than 700,000 compared to 2020.

By contrast, the Cybersecurity Workforce Gap is the number of additional professionals that organisations need to adequately defend their critical assets. For the second consecutive year, the Cybersecurity Workforce Gap has decreased, down to 2.72 million compared to 3.12 million in 2020.

Together, the Cybersecurity Workforce Estimate and Cybersecurity Workforce Gap suggest the global cybersecurity workforce needs to grow 65% to effectively defend organisations’ critical assets.

1. Investment in cybersecurity training –  

What can be done to address the cybersecurity skill shortage?

Organisations need to invest in appropriate cybersecurity training and education so candidates can be properly skilled for their roles. Cybersecurity professionals must keep up with their skills or the organisations they work for are at a significant competitive disadvantage.

According to the ‘Cyber Security Skills in the UK Labour Market 2022’ report, approximately 697,000 businesses (51%) have a basic skills gap. That is, the people in charge of cyber security in those businesses lack the confidence to carry out the kinds of basic tasks laid out in the government-endorsed Cyber Essentials scheme, and are not getting support from external cyber security providers. The most common of these skills gaps are in setting up configured firewalls, storing or transferring personal data and detecting and removing malware.

• HR and cybersecurity teams need to align on business value –

Organisations may need to spend a significant amount of time and resources on recruitment efforts, which can be costly and time-consuming. Additionally, because there is so much competition for skilled cybersecurity professionals, organisations may need to offer high salaries and other incentives to attract and retain top talent.

• Business and cyber leaders need to collaborate –

Business executives must embrace cybersecurity as a core component of the business while Chief Information Security Officers need to move their people, processes and technologies closer to the business goals.

• Cybersecurity professionals need fair and competitive compensation –

Not offering competitive compensation is a top factor contributing to organisations’ cyber skills shortage because it makes it difficult to recruit and hire the appropriately skilled cybersecurity professionals that organisations need.

• Deploy intelligence and automation for manual tasks –

To address the cybersecurity skills shortage, many organisations are turning to automation and Artificial Intelligence (AI) to help manage their security operations. Automation and AI technologies can help detect and respond to threats more quickly and efficiently, without the need for as many human resources.

At a consumer level, AI can help spot phishing websites and filter spam. At an organisational level, AI can support teams of security analysts who might have to detect and investigate hundreds of security incidents per year. The AI system can look for threats to the business and alert employees to investigate or respond when anomalies occur.

Cognitive technologies can also contribute to behavioural analytics that can defend against insider threats, identify compromised employee credentials or quickly detect breaches.

Interactive data analysis, proactive discovery and threat characterisation can empower cyber professionals and extend their capabilities far beyond the scope of what could be accomplished alone by even the most talented workforce.

However, it’s important to note that automation and AI are not a complete solution to the cybersecurity workforce shortage. They can help to augment existing security teams and improve efficiency, but human expertise is still critical for developing and implementing effective cybersecurity strategies.

• Managed Security Services –

The cybersecurity skills shortage is pushing many organisations to consider managed security service offerings rather than trying to compete for that talent and grow the capabilities in-house.

Securus can provide end-to-end security solutions to help maintain IT integrity. Only by developing and implementing an integrated threat management strategy can organisations mitigate security breaches.

We support all aspects of threat management and prevention through proper threat research and scanning, monitoring the network infrastructure for signs of malicious activity, then responding quickly to any incidents that may occur. We offer tailored solutions covering both internal and external threats, and a constant review methodology to ensure that new threats are detected early.

Securus provides a range of network connectivity backup solutions and can deploy a multi-carrier design for added resilience. We will also recommend and implement the most appropriate firewall solution for your business.

Conclusion

With the threat landscape rapidly changing rapidly and the sophistication and numbers of threat variants becoming more complex, traditional approaches are falling short.

Human expertise is still critical for developing and implementing effective cybersecurity strategies. Organisations need to continue investing in training and education to develop the next generation of cybersecurity professionals, or alternatively, outsource their cybersecurity needs to a managed security service provider.

For more information on how Securus can help, call our security experts on 03451 283457.