The cybersecurity skills gap reality: We need to face the challenge of emerging tech – Source: www.csoonline.com

The cybersecurity skills shortage remains a controversial topic. Research from ISC2 states that the current global workforce of cybersecurity professionals stands at 5.5 million, but the workforce currently needs 10.2 million — a gap of 4.8 million people.

Skeptics (and there are lots of them) say hogwash! They claim that these numbers are purely self-serving for ISC2, an organization that sells cybersecurity certifications. They also point to the eternal disconnect between security managers and HR/recruiters.

If only HR managers and industry recruiters truly understood cybersecurity job requirements and posted appropriate job listings, they could easily fill open requisitions. Finally, doubters point to cybersecurity layoffs at companies like Yahoo! and the current wave of cybersecurity budget cuts. How can these things happen if everyone is understaffed?

As for me, I’m not sure how ISC2 derived its numbers, but according to new research from the ISSA and my former employer ESG, 63% of cybersecurity professionals say that their organization has been impacted by the global cybersecurity skills shortage, leading to increasing workloads, an inability to optimize existing security technologies, and staff burnout. Oh, and by the way, cybersecurity professionals have been saying these things for many years.

Where are cyber staffing shortages the most acute?

As part of the research, we also asked organizations about their ability to recruit and hire cybersecurity professionals. The data indicated that onboarding remained a challenge: 11% reported it was extremely difficult to recruit and hire cybersecurity professionals, 30% claimed it was difficult, and 43% admitted it was somewhat difficult.

Whatever you might believe, the numbers keep showing us that there’s some type of chronic cybersecurity skills shortage in play. Where is it hitting organizations the hardest? Three of the top four areas included cloud computing security (33%), application security (33%), and security operations (24%).

These three have remained consistent for the past several years, with either cloud or application security topping the charts. In this year’s survey, however, we added a new choice — cybersecurity skills around emerging technologies. Surprisingly, this new entry led the field in 2024 as 40% of organizations have an acute shortage of cybersecurity skills in this area.

Now, I know what you’re thinking: “Emerging technologies is a nebulous term. What does this really mean?” When I asked several CISOs what came to mind, most immediately pivoted to artificial intelligence.

The research reinforced this opinion — 64% of survey respondents were concerned about the lack of a skilled workforce to develop, implement, and manage AI systems and technologies. Taken together, this can be seen as a serious lifecycle problem where organizations don’t have the right skills to build and deploy AI applications, let alone secure them.

This tells me that a ‘crawl, walk, run’ approach to AI is most appropriate, but many firms will approach AI as a 100-meter dash and suffer the consequences. Yikes!

There are emerging technologies beyond AI

Beyond AI, other emerging technologies mentioned in my conversations included IoT/OT, edge computing applications, augmented reality, virtual reality, and even 3D printing. Lacking the right skills, CISOs must do their best to assess the risks associated with these technologies, implement compensating controls, and continuously monitor emerging technology behavior.

As I mentioned, I’m not sure about ISC2 or other numbers, but years of data analysis tell me that the security skills shortage is real and persistent. Furthermore, the adoption of emerging technology is more pervasive and rapid than ever before.

The data suggests that CIOs must dig into details and plans around any business initiatives involving emerging technologies. It’s not enough to know these things are happening. Rather, CISOs must know exacting specifics on the technologies in play, what they will be connected to, who has access to them, and when they are planned for deployment.

Armed with this information, CISOs can get their team involved during the planning process so they can train, develop risk models, educate business leaders on potential risks, and get an adequate budget for any security countermeasures, personnel, or training necessary.

Meanwhile, corporate business leaders must acknowledge these realities and inconsistencies, making sure to evaluate and mitigate risks while addressing skills needs as they proceed.

Note: The 2024 ESG/ISSA research eBook, The Life and Times of Cybersecurity Professionals (v7), is available for free download here.