Can AI Help Reduce The Cybersecurity Workforce Gap?

Much has been made of whether Artificial Intelligence (AI) will steal our jobs but what if it could do the opposite and help us to resolve the current skills crisis? According to (ISC)2 there are 3.4m job vacancies in cybersecurity worldwide, equivalent to 42% of the total workforce and its growing, with 14,100 vacancies arising every year in the UK alone. 

These skills shortages have already forced businesses to look at where they can automate processes, with 17% of organisations using AI/ML and automation in cybersecurity operations, according to (ISC)2. But such figures predate the emergence of generative AI.

Now, according to the Future of Work 2023 study by the World Economic Forum (WEF), 75% of businesses intend to adopt AI and automation technologies over the next five years. Moreover, automation is now regarded as a primary workforce strategy that 80% of organisations intend to pursue. 

AI As An Aid

There’s now much more belief in the ability of the technology to aid us in tasks. AI is already being used in a cybersecurity context to generate reports and documentation in GRC. It’s able to draw from libraries and rapidly write secure code which means it could be used to both create and debug code jeopardising those in DevSecOps. Penetration testers and red teamers are also likely to use its capabilities to create phishing tests and social engineering exercises as it can grab OSINT from social media platforms etc. 

These and other use cases illustrate the ability of the technology to lighten the load of security teams and that’s vitally important because stress is directly contributing to the workforce gap. A recent survey found that over half of UK IT industry decision makers think they will lose cybersecurity staff this year due to burnout.

Alleviating the pressure on security personnel also frees up resource, so that instead of having to start from scratch when generating code or a report, the cybersecurity professional simply needs to check, verify and extend the results produced by the AI. This is likely to see job remits change overtime, and AI skills become prized.  

Changing Roles

The same WEF survey found that AI and big data roles are predicted to grow 30-35% over the next five years. Furthermore, while AI only ranks 15th on its list of core skills today, that is still well above the ranking of computer programming, network and cybersecurity skills, suggesting AI will soon be regarded as an essential core skillset. 

We’re also now seeing vendors offer the technology alongside their solutions. This enables their customers to use AI to summarise SOC incident reports and SOAR playbook outputs, for instance, improving the speed of response. And these advances are driving investment.

A recent Blackberry survey revealed that 48% of IT decision makers plan to buy AI-driven cybersecurity solutions during the course of this year and 82% over the next two years.

Taking all these factors into consideration, it appears that AI is in many ways a logical extension of the automation we’ve already seen in the industry, such as automated threat hunting, incident response, and even red teaming. It’s by no means perfect and as with any tool the results will need to be verified with quality checks in place. But it does move us on from the point of cybersecurity being a purely technical career.

The Human Factor

As we’ve seen in recent reports such as the (ISC)2 Cybersecurity Hiring Managers Guide, soft skills are becoming far more sought after and valued. They’re a core part of any cybersecurity job interview, with the top non-technical skills being the ability to work in a team and independently, with project or customer facing experience, and good presentation skills.

Top soft skills include problem solving, creativity, analytical thinking, the desire to learn and critical thinking. This is because it is now widely acknowledged that while technical skills can be taught, these other skillsets are innate.

Of course, many cybersecurity jobs do require technical competency but there are now such a diversity of roles and skillsets that the UK Cyber Security Council has been tasked with mapping these into a Cyber Career Framework using 16 Cyber Pathways. In a similar fashion, the EU launched its European Cybersecurity Skills Framework (ECSF) in September to enable employers, recruiters and candidates to more accurately advertise job positions and plan their workforce. 

My guess would be that those roles will again morph over time as AI begins to permeate the workplace and we’ll see prompting, for example, become core skillset.

We can expect some roles to merge, others to expand and new ones to evolve – but the constant will be the human in the machine. AI has great potential and will almost certainly help alleviate the cyber skills shortage. But it is no substitute for human intellect, intuition, reasoning and analysis.

Jamal Elmellas is COO at Focus-on-Security                      Image:  Adi Goldstein on Unsplash

You Might Also Read: 

The Skills Gap Is Increasing Risk & Exposure To Attack:

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« Malvertising Proliferates As Half Of Online Ads Are Now AI Generated 
Zero Trust: A Paradigm Shift in Cybersecurity »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

TÜV SÜD Academy UK

TÜV SÜD Academy UK

TÜV SÜD offers expert-led cybersecurity training to help organisations safeguard their operations and data.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

Zybert Computing

Zybert Computing

Zybert Computing provide server solutions with built-in security and information protection features for the SME market.

Protegrity

Protegrity

Protegrity is an enterprise and cloud data security software for data-centric encryption and tokenization to protect sensitive data while maintaining usability.

Stott & May

Stott & May

Stott & May is a specialist cyber security recruitment agency.

IABG

IABG

IABG offer independent, product-neutral consulting as well as technical and scientific services for the use of safety-relevant systems and technologies.

LuJam Cyber

LuJam Cyber

LuJam Cyber is a cybersecurity company that provides protection to SME Networks.

Assertion

Assertion

Assertion secures your collaboration (UC/CC) systems from cyber risks. Enforcing the right set of controls and monitoring them continually brings down risk to acceptable levels.

Pluribus One

Pluribus One

Pluribus One develops customized solutions and other data-driven applications to secure your business and your devices.

Attack Research

Attack Research

We go far beyond standard tools and scripted tests. Find out if your network or technology can stand real-world and dedicated attackers.

SecuLetter

SecuLetter

SecuLetter is able to detect unknown attacks with hybrid approaches, static and dynamic analysis.

IntelligInts

IntelligInts

IntelligInts provide 24×7 threat monitoring, hunting, alerting, and mitigation in our world class Security Operations Center.

Kordia

Kordia

Kordia is a leading provider of mission-critical technology solutions throughout Australasia. We have the most comprehensive cyber security offering in New Zealand.

Stacklet

Stacklet

Stacklet provides cloud governance as code platform that accelerates how Global 2000 manages its security, asset visibility, operations, and cost optimization policies in the cloud.

StarLink

StarLink

StarLink is an acclaimed Value-Added Distributor across the Middle East, Turkey and Africa regions with on-the-ground presence in 20 countries including UK and USA.

Core4ce

Core4ce

Core4ce is a mission-oriented company that serves as a trusted partner to the national security community.

Veza Technologies

Veza Technologies

Veza is the authorization platform for data. Built for hybrid, multi-cloud environments, Veza enables organizations to manage and control who can and should take what action on what data.

Superna

Superna

Superna is the global leader in data security and cyberstorage solutions for unstructured data, both on-prem and in the hybrid multi-cloud.