Has Demand For Cyber Security Skills Hit Crisis Point?

The Parliament's Joint Committee on the National Security Strategy, a cross-party group that works across both the Commons and Lords, published a report in July that exposed the UK's chronic lack of digital skills, even within some of its own security agencies.

A summary to the report, entitled Cyber Security Skills and the UK's Critical National Infrastructure, reads as follows: "During our ongoing inquiry into the cyber security of the UK's critical national infrastructure (CNI), we heard that although the UK has one of the most vibrant digital economies in the world, there is not currently the cyber security skills base to match, with both the Government and private sector affected by the shortage in skills".

The committee heard from some of those at the forefront of the UK's cyber security industry. Ciaran Martin, CEO of the National Cyber Security Centre (NCSC), who told the committee he found it a "constant and difficult challenge" to recruit the deep technical expertise needed. It also heard from Rob Crook, managing director of Cyber and Intelligence at the defence engineering and cyber security company Raytheon UK, who put the vacancy rate in the company's cyber security unit at 20–30%.

The committee says it was "struck by the Government's apparent lack of urgency in addressing the cyber security skills gap in relation to CNI", and that it believes the government lacks the ability and understanding to address the gap between skills supply and demand.

The need for new blood

Fixing the problem may prove to be quite a challenge. BCS, the Chartered Institute for IT, says it was dismayed by this year's GCSE results which showed a 16.6% fall in the number of students sitting a computing-related topic. When IT Pro spoke to BCS, a spokesperson told us that we "need a critical mass of new blood entering the profession to close that skills gap".

The spokesperson pointed to the UK's National Security Strategy 2016-2021, which had identified that "the lack of young people entering the profession" and "the absence of established career and training pathways into the profession" were two of the main factors contributing to the skills gap.

As we reported in August, analysis of figures released by UCAS in August showed a noticeable decline in the number of students pursuing STEM-related subjects at university, despite a growth in interest at A-level.

BCS proposed fostering more "apprenticeships in cyber security, which as well as providing an extremely worthwhile career, are also well-paid, with salary expectations typically 15% above the industry standard".

However, according to Bryan Betts, principal analyst at Freeform Dynamics, this "arms race" has been a prevailing problem for many years and almost certainly going to get worse.

"There is some good news on the horizon – more students passing A-level computing this year, for instance – but of course they're going to need to learn a lot more to be useful in cybersecurity," he explains.

Making cyber security attractive

Talal Rajab, head of programme for Cyber and National Security at techUK, told us the organisation is working closely with Department for Digital, Culture, Media and Sport (DCMS) on setting up a "professional body for cyber security that would grant royal chartered status to cyber professionals". This would effectively raise the position above other IT industries, where professionals would be required to act in accordance with ethical guidelines, for the good of the public.

BCS appears to be in broad agreement with this strategy. "Cyber events continue to have a growing impact on our society, and we can no longer manage this as a technology issue in isolation," its spokesperson told us. "The demands of the organisations and institutions like the NHS that we protect, mean that the whole issue of cyber risk management needs to be professionalised."

Prestige is certainly one way to attract more people to the profession, but they won't all want to work for a public body.

"People with strong cybersec skills are out there, but there's not nearly enough, and many of them don't want to work for a government," says Betts. "That might change if the UK government could foster a startup-like environment, but the current lot give the impression they'd have trouble fostering a hamster, never mind a startup."

Cyber security skills strategy

As Betts explains, the major problem facing the government is that this issue requires a long-term commitment, as "it's probably a ten-year project to build up the skills base".

And there's the rub. While there's a challenge in recruiting right now, it could get a lot worse if we don't have a plan in place to ensure that people take up the kinds of subjects at school that will encourage them towards a career in cyber security.

The Joint Committee on the National Security Strategy is backing the proposal for such a plan. Its report urges the government to work with industry to help formulate a robust education policy that will deliver the skills needed in the future, as well as support continuing professional development for educators. It also suggests reskilling and using aptitude rather than qualifications as a basis for recruitment.

The committee also believes "the Government's immediate priority should be the publication of a cyber security skills strategy," as until the homegrown workforce is available, the industry needs to be aware of how the government plans to alleviate the strain.

Perhaps when that appears, we will get a better idea of the government's strategies for the months and years ahead.

ITPro:

You Might Also Read:

AI & Machine Learning Are Adding To The Skills Shortage

« Millions Of WiFi Routers Are At Risk Of Hacking
Spyware Proliferates To 45 Countries »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

Resecurity

Resecurity

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

ZenGRC

ZenGRC

ZenGRC (formerly Reciprocity) is a leader in the GRC SaaS landscape, offering robust and intuitive products designed to make compliance straightforward and efficient.

Infosecurity Europe, 3-5 June 2025, ExCel London

Infosecurity Europe, 3-5 June 2025, ExCel London

This year, Infosecurity Europe marks 30 years of bringing the global cybersecurity community together to further our joint mission of Building a Safer Cyber World.

CEPS

CEPS

CEPS is a leading think tank and forum for debate on EU affairs, ranking among the top think tanks in Europe. Topic areas include Innovation, Digital economy and Cyber-security.

ResponSight

ResponSight

ResponSight is a data science company focusing specifically on the challenge of measuring risk and identifying changes in enterprise/corporate networks using behavioural analytics.

Atlantic Security Conference (AtlSecCon)

Atlantic Security Conference (AtlSecCon)

Atlantic Security Conference is a non-profit, annual, information security conference located in Halifax, Nova Scotia, Canada.

Energia Ventures

Energia Ventures

Energia Ventures is a three-month intensive accelerator for entrepreneurs with an innovative business in the energy, smart grid, cleantech, and cybersecurity sectors.

In-Sec-M

In-Sec-M

In-Sec-M is a non-profit organization that brings together companies, learning and research institutions, and government actors to increase competitiveness of the Canadian cybersecurity industry.

Clario Tech

Clario Tech

Clario is a simple, comprehensive, personalized protection app. It comes with a full suite of intelligent security software and intelligent people to help you live a better, safer digital life.

Britive

Britive

The Britive Platform is a cloud-native security solution built for the most demanding cloud-forward enterprises.

Goldilock

Goldilock

Goldilock is redefining how sensitive data, devices, networks and critical infrastructure can be secured.

StealthPath

StealthPath

StealthPath is focused on endpoint protection, securing the “implicit trust” vulnerabilities of current leading information security solutions.

Aembit

Aembit

Aembit is the Identity Platform that lets DevOps and Security manage, enforce, and audit access between federated workloads

Saudi Information Technology Company (SITE)

Saudi Information Technology Company (SITE)

SITE is a forward-thinking enterprise, which aims at revitalizing Saudi Arabia’s digital infrastructure, cybersecurity, software development, and big data and analytics capabilities.

Silverse

Silverse

At Silverse, we specialize in building a comprehensive cybersecurity journey, anchored by our extensive experience, industry expertise, and an ecosystem of trusted partners.

NVISO Security

NVISO Security

NVISO is a pure-play cyber security consulting firm, focused mainly on the Financial Sector, the Technology Sector, and Government & Critical Infrastructure.

HTX (Home Team Science & Technology Agency)

HTX (Home Team Science & Technology Agency)

HTX brings together science and engineering capabilities to transform the homeland security landscape and keep Singapore safe.

Vana Solutions

Vana Solutions

Vana Solutions is an Information Technology Services company. We help commercial & federal organizations select, adapt, and integrate the right technology solution so you can move faster.

COcyber

COcyber

COcyber aims to enhance collaboration between the cybersecurity civilian and defence spheres. It is a two-year project funded by the European Union and it kicked off in July 2024.