Ongoing hiring and retention challenges, as well as key workforce gaps both in technical cybersecurity skills and soft skills, are illuminated in ISACA’s newly released annual research report, State of Cybersecurity 2023, Global Update on Workforce Efforts, Resources and Cyberoperations.
The State of Cybersecurity 2023 report indicates some strides have been made in addressing employee retention, but it continues to challenge enterprises looking to sustain robust security teams. More than half (56 percent) of cybersecurity leaders say they have difficulty retaining qualified cybersecurity professionals, though this number is down four points from last year.
Continuing to reduce retention woes may be difficult, considering that benefits offered to cybersecurity professionals have been declining—potentially driven by economic uncertainty. University tuition reimbursement dropped five percentage points to 28 percent, recruitment bonuses fell two percentage points, and reimbursement of certification fees dropped by a percentage point, compared to 2022.
When hiring, respondents say they are looking for the following top five technical skills in cybersecurity pros:
- Identity and access management (49 percent)
- Cloud computing (48 percent)
- Data protection (44 percent)
- Incident response (44 percent)
- DevSecOps (36 percent)
When it comes to soft skills, communication (58 percent), critical thinking (54 percent), problem-solving (49 percent), teamwork (45 percent) and attention to detail (36 percent) come in as the top five skills employers are seeking in cybersecurity job candidates. The skills of empathy (13 percent) and honesty (17 percent) came in lower in importance—a noteworthy finding given that 62 percent of respondents believe organizations underreport cybercrime.
The global survey respondents also examined where cybersecurity professionals are most lacking—citing soft skills (55 percent), cloud computing (47 percent), security controls (35 percent), coding skills (30 percent) and software development-related topics (30 percent) as the biggest skills gaps they observe today.
“The soft skills gaps we see among cybersecurity professionals are part of a concerning systemic issue that our industry needs to take seriously,” says Jon Brandt, ISACA Director, Professional Practices and Innovation. “While there is no simple solution, addressing these needs with a collaborative approach that goes beyond traditional academia to involve hands-on training, mentorship, and other learning pathways can make an impact not only on individual skillsets and enterprise security outcomes, but also on the integrity of the profession as a whole.”
The workforce dynamics of the cybersecurity landscape are also being impacted by new risks and opportunities created by artificial intelligence, which has become increasingly top-of-mind for cybersecurity professionals and cybercriminals alike.
“Artificial Intelligence (AI) is reshaping the cybersecurity landscape,” writes Jason Lau, CGEIT, CRISC, CISA, CISM, CDPSE, CISSP, CIPP/E, CIPM, CIPT, CEH, HCISPP, FIP, ISACA Board Director, and Chief Information Security Officer at Crypto.com, in an ISACA Now blog post. “While AI-driven solutions offer enhanced threat detection and automated responses, they also introduce novel vulnerabilities. Adversarial attacks, data poisoning and model inversion are just a few examples of how AI systems can be compromised.”
A complimentary copy of the State of Cybersecurity 2023 survey report can be accessed at www.isaca.org/state-of-cybersecurity-2023, along with related resources. Additional cybersecurity resources can be found at www.isaca.org/resources/cybersecurity.