creative soul - Fotolia


Effects of cybersecurity skills shortage worsening, new study says

The cybersecurity skills shortage is putting businesses at risk in a variety of ways, according to a new study. Experts suggest ways to combat the problem.



Major ramifications of the worsening cybersecurity skills shortage include the following:

  • existing staff being overworked (66%);


"One of my takeaways: Nothing's improving," said Jon Oltsik, senior principal analyst at ESG in Milford, Mass., and author of the report. "All of the programs you hear about, [including] the executive order, all that's good, because we are getting the attention, but none of them are making a dent in the problem."



A whopping 93% of respondents agreed they must keep up with their skills or their organization will be at risk, but 66% of respondents said it's hard to keep up with cybersecurity skills, given the demands of their job.

"While cybersecurity professionals need to keep their skill sets up, they're too busy, and their organization isn't providing them with enough training," Oltsik said. "That means I, as a cybersecurity professional, need to go out on my own and figure out how to get that training. And that's not good for the organization, it's not good for me, and it's not good for any of us who depend on these people to protect our data."

How organizations are being affected by the cybersecurity skills shortage

Combating the cybersecurity skills shortage

Alexander said it's time to adopt a different approach for solving the cybersecurity skills shortage.

"I would advocate that this is really not a security problem, [and] it's really not a technology problem --this is actually a business problem," she said. "There's a whole bunch of opportunity when we look at it from that business perspective, as opposed to it being a security problem."


"I actually see it as an opportunity to bring people in to our profession that may not have the traditional skill sets," she said. "It's an opportunity for us to grow them to become professionals that we need within our organizations."


"There are people who are interested, and investing in the talent you have is valuable," Beek said.


Jon OltsikSenior principal analyst at ESG

"Honestly, nobody tells the students of today the opportunity that there is in cybersecurity and how cool the job is," he said.


"For example, a security analyst that looks at security reports and data generated from scanning tools, they are evaluating data. So, why couldn't we go over to the other side of the house and look at data analysts and pull them in?"


"Another thing that we're seeing is cybersecurity professionals are seeking help," Oltsik said. "The services business is growing much faster than the product business in security, because organizations feel like they need help and they're going to experts. That's good, but they do have to develop a skill set on managing third-party service providers and not just take it for granted that those people will help them out."

Acute cybersecurity skills shortage areas

Working with the business

According to the report, 23% of respondents said business managers don't understand or support the appropriate level of cybersecurity in their organization. Alexander encouraged cybersecurity professionals to talk to their employers and show interest in learning about their business goals and initiatives.

"Their job is to support the business and not stop it from happening," Alexander said.



"A lot of businesses use the ratio of cybersecurity staff and/or budget according to the size of staff and budget for IT," Alexander said. "That's just really an outdated way of looking at it, and it's really quite dangerous. When we talk about staffing and budgets, we need to look at it from a risk perspective, as opposed to getting compared to our brethren on the technology side of the house."

Dig Deeper on Information security certifications, training and jobs