Can AI Help Reduce The Cybersecurity Workforce Gap?

Uploaded on 2023-07-10 in TECHNOLOGY-Key Areas-Artificial Intelligence, JOBS-Careers, FREE TO VIEW

Much has been made of whether Artificial Intelligence (AI) will steal our jobs but what if it could do the opposite and help us to resolve the current skills crisis? According to (ISC)2 there are 3.4m job vacancies in cybersecurity worldwide, equivalent to 42% of the total workforce and its growing, with 14,100 vacancies arising every year in the UK alone.

These skills shortages have already forced businesses to look at where they can automate processes, with 17% of organisations using AI/ML and automation in cybersecurity operations, according to (ISC)2. But such figures predate the emergence of generative AI.

Now, according to the Future of Work 2023 study by the World Economic Forum (WEF), 75% of businesses intend to adopt AI and automation technologies over the next five years. Moreover, automation is now regarded as a primary workforce strategy that 80% of organisations intend to pursue.

AI As An Aid

There’s now much more belief in the ability of the technology to aid us in tasks. AI is already being used in a cybersecurity context to generate reports and documentation in GRC. It’s able to draw from libraries and rapidly write secure code which means it could be used to both create and debug code jeopardising those in DevSecOps. Penetration testers and red teamers are also likely to use its capabilities to create phishing tests and social engineering exercises as it can grab OSINT from social media platforms etc.

These and other use cases illustrate the ability of the technology to lighten the load of security teams and that’s vitally important because stress is directly contributing to the workforce gap. A recent survey found that over half of UK IT industry decision makers think they will lose cybersecurity staff this year due to burnout.

Alleviating the pressure on security personnel also frees up resource, so that instead of having to start from scratch when generating code or a report, the cybersecurity professional simply needs to check, verify and extend the results produced by the AI. This is likely to see job remits change overtime, and AI skills become prized.

Changing Roles

The same WEF survey found that AI and big data roles are predicted to grow 30-35% over the next five years. Furthermore, while AI only ranks 15th on its list of core skills today, that is still well above the ranking of computer programming, network and cybersecurity skills, suggesting AI will soon be regarded as an essential core skillset.

We’re also now seeing vendors offer the technology alongside their solutions. This enables their customers to use AI to summarise SOC incident reports and SOAR playbook outputs, for instance, improving the speed of response. And these advances are driving investment.

A recent Blackberry survey revealed that 48% of IT decision makers plan to buy AI-driven cybersecurity solutions during the course of this year and 82% over the next two years.

Taking all these factors into consideration, it appears that AI is in many ways a logical extension of the automation we’ve already seen in the industry, such as automated threat hunting, incident response, and even red teaming. It’s by no means perfect and as with any tool the results will need to be verified with quality checks in place. But it does move us on from the point of cybersecurity being a purely technical career.

The Human Factor

As we’ve seen in recent reports such as the (ISC)2 Cybersecurity Hiring Managers Guide, soft skills are becoming far more sought after and valued. They’re a core part of any cybersecurity job interview, with the top non-technical skills being the ability to work in a team and independently, with project or customer facing experience, and good presentation skills.

Top soft skills include problem solving, creativity, analytical thinking, the desire to learn and critical thinking. This is because it is now widely acknowledged that while technical skills can be taught, these other skillsets are innate.

Of course, many cybersecurity jobs do require technical competency but there are now such a diversity of roles and skillsets that the UK Cyber Security Council has been tasked with mapping these into a Cyber Career Framework using 16 Cyber Pathways. In a similar fashion, the EU launched its European Cybersecurity Skills Framework (ECSF) in September to enable employers, recruiters and candidates to more accurately advertise job positions and plan their workforce.

My guess would be that those roles will again morph over time as AI begins to permeate the workplace and we’ll see prompting, for example, become core skillset.

We can expect some roles to merge, others to expand and new ones to evolve – but the constant will be the human in the machine. AI has great potential and will almost certainly help alleviate the cyber skills shortage. But it is no substitute for human intellect, intuition, reasoning and analysis.

Jamal Elmellas is COO at Focus-on-Security Image: Adi Goldstein on Unsplash

You Might Also Read:

The Skills Gap Is Increasing Risk & Exposure To Attack:

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.