Struggling With The Cyber Security Skills Shortage

Nearly three out of four organisations are struggling with a gap in security skills.  While non-IT professionals  consider cyber security professionals in a positive light, few of them are interested a career in IT. In fact, 68% of all IT and security professionals say they have to work on advancing their cyber skills on their own time.

New research shows how security skills are lacking across multiple IT disciplines,  including network engineers, systems administrators and cloud developers. 

According to new data from Cybrary, 46% of organisations do not confirm new-hires' skills for specific roles and 40% rarely or never assess the skills of newly on-boarded team members. IT and security professionals are avidly working to improve their skills on their own personal time, even while reporting cost and lack of time as significant barriers. Respondents overwhelmingly preferred online learning for job-related skills (62%) including online courses, virtual labs, and web-based media to help them gain new skills for improving current job performance and advancing their careers. 

According to survey respondents, IT and security professionals want to improve their job skills with 40% spending time every day, while another 38% at least once a week. Nearly half (48%) invest their own time before and after work, or on weekends (20%) to improve their skills. However, cost (33%) and lack of time (28%) are the main barriers preventing IT and security professionals from getting the skills development training they need to do their jobs to the best of their abilities. Even more disturbing, 40% say these barriers have a major/severe impact on developing their skills. 

Another report by the Enterprise Strategy Group (ESG), and the Information Systems Security Association (ISSA) professionals reveal that cyber security skills continue to deteriorate for the fourth year in a row. This situation has affected over 70% of organisations putting their operations at risk. 

The data uncovered in this research year over year also demonstrates that there are multiple issues contributing to the problem of “a cybersecurity skills gap.” 

This includes the problem that businesses don’t understand the role of information security and there is no clear and agreed upon career map within our profession, and cyber security professionals are under constant stress of attempting to improve collaboration efforts with IT. 

Respondents clearly indicated a preference for learning through online, self-paced courses (38%) along with online virtual labs (17%). Their motivation appears to focus on improving their current job performance (25%) or advancing their careers (29%), rather than pursuing a new career path (13%). 

IT and security team members are not getting the full support they need to improve skills since about half of organisations have either decreased their training budgets (22%) or kept them the same (25%) this past year. Even more disturbing, 16% of respondents report their organisations do not have any training budget at all. 

The studies show that the lack of a well-defined career path for cyber security professionals was mainly to blame for the cyber security skills gap. 

About 68% of the professionals interviewed did not have a defined career path. Additionally, historical solutions implemented to address the problem only made it worse. The fundamental causes for the skill gap are myriad, starting with a lack of training and career-development opportunities. About 68 percent of the cyber security professionals surveyed said they don’t have a well-defined career path. They say they don’t have basic growth activities, such as finding mentor, getting basic cyber security certifications, taking on cyber security internships and joining a professional organisation, are missing steps in their endeavors.

The survey also found that many professionals start out in IT, and find themselves working in cyber security without a complete skill set. 

A full 63 percent of respondents in the survey said they’ve worked in cyber security for less than three years, with 76 percent starting as IT professionals before switching their career to cyber security. All of this comes as cyber-attacks continue to ramp up. Survey respondents were asked to compare the status of cyber-adversaries with that of cyber-defenders, and 67 percent of respondents said they believe that cyber adversaries have a big advantage.

ISSA:   CPO Magazine:   Infosecurity Magazine:   Threatpost:     Dark Reading:

You Might Also Read

Sentiment About Cyber Security Professionals Improves:

 

 

« The Same Russians Who Hacked Clinton Are Targeting Biden
Technology Trends to Watch Out For »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

Infosecurity Europe, 3-5 June 2025, ExCel London

Infosecurity Europe, 3-5 June 2025, ExCel London

This year, Infosecurity Europe marks 30 years of bringing the global cybersecurity community together to further our joint mission of Building a Safer Cyber World.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

Akin Gump Strauss Hauer & Feld

Akin Gump Strauss Hauer & Feld

Akin is a leading global law firm providing innovative legal services and business solutions to individuals and institutions. Practice areas include Cybersecurity, Privacy and Data Protection.

Leibniz-Rechenzentrum (LRZ)

Leibniz-Rechenzentrum (LRZ)

The LRZ supports ground-breaking research and teaching in a wide range of scientific disciplines including information security and data protection.

ComTrue Technologies

ComTrue Technologies

ComTrue Technologies provides artificial intelligence solutions and information security solutions.

Payatu

Payatu

Payatu Technologies is a security testing and services company specialized in Software, Application and Infrastructure security assessments and deep technical security training.

Pareteum

Pareteum

Pareteum is a leading Global provider of mobile networking software and services. Our mission is to provide a single solution to the problem of fully enabling and securing the Mobile Cloud.

Kleiner Perkins

Kleiner Perkins

For five decades, Kleiner Perkins has made history by partnering with some of the most ingenious and forward-thinking founders in technology and life sciences.

Snode Technologies

Snode Technologies

Snode's Guardian cybersecurity platform uses AI and machine learning to monitor, detect and proactively respond to all threats on every device within your network.

Inflection Point Ventures (IPV)

Inflection Point Ventures (IPV)

Inflection Point Ventures (IPV) is a 6000+ members angel investing firm which supports new-age entrepreneurs by connecting them with a diverse group of investors.

Nuance Communications

Nuance Communications

From revolutionizing the doctor-patient relationship to reinventing the way brands connect with their customers, Nuance technology helps organizations push the boundaries of what’s possible.

PolySwarm

PolySwarm

PolySwarm is a crowdsourced threat intelligence marketplace that provides a more effective way to detect, analyze and respond to the latest threats.

Castlepoint Systems

Castlepoint Systems

Castlepoint Systems is a pioneer in information governance, risk and compliance as a service. An all-in-one solution offering powerful risk management, built in compliance, cybersecurity and audit.

V2X

V2X

V2X delivers IT support, networking, and cybersecurity solutions that ensure optimal mission support and performance.

Silverse

Silverse

At Silverse, we specialize in building a comprehensive cybersecurity journey, anchored by our extensive experience, industry expertise, and an ecosystem of trusted partners.

Gutsy

Gutsy

Gutsy uses process mining to help organizations visualize and analyze their complex security processes to understand how they actually run, based on observable event data.

Keeran Networks

Keeran Networks

Established in Edmonton in 1999, Keeran specializes in delivering comprehensive IT support and solutions aimed at optimizing technology investments for businesses.

Nicos AG

Nicos AG

Nicos AG specializes in secure, global data communication.