61% of cybersecurity teams are understaffed

The pandemic’s disruption has rippled across the globe, impacting workforces in nearly every sector. However, according to the findings from a survey report from ISACA and HCL Technologies, the cybersecurity workforce has largely been unscathed, though all-too familiar challenges in hiring and retention continue at levels similar to years past.

understaffed cybersecurity teams

The results show that just 53 percent of the 3,600 information security professionals who participated in the survey indicated they had difficulty retaining talent last year during the pandemic—a four percentage point decline from the year before, which may have been a side effect of uncertainty amidst COVID-19.

In a climate where remote work became more prevalent—and in some cases, mandatory—those citing “limited remote work possibilities” as a reason for leaving their cybersecurity role saw a six-percentage point decline (45%) compared to the year before.

Though the cybersecurity workforce was mainly spared the pandemic devastation experienced by other sectors, the survey found that longstanding issues persist, including:

  • 61 percent of respondents indicate that their cybersecurity teams are understaffed.
  • 55 percent say they have unfilled cybersecurity positions.
  • 50 percent say their cybersecurity applicants are not well qualified.
  • Only 31 percent say HR regularly understands their cybersecurity hiring needs.

Understaffed cybersecurity teams and attacks issues

As in years past, the findings show that retention issues and increased cyberattacks are somewhat interrelated. Sixty-eight percent of respondents who experienced more cyberattacks in the past report being somewhat or significantly understaffed, and 63 percent who experienced more cyberattacks in the past indicated they have experienced difficulties retaining qualified cybersecurity professionals.

“It has become even more evident in the past year just how vital cybersecurity is to ensuring business continuity, yet the years-long struggle to staff these teams continues,” said Jonathan Brandt, ISACA information security professional practices lead.

“As a global cybersecurity community, it is imperative that we all come together to recalibrate how we hire, retain and train our future cyber leaders to ensure we have a solid workforce to meet these evolving cybersecurity needs.”

Hiring and skills challenges persist, especially with recent graduates

Despite the high demand for cybersecurity jobs, 50 percent of those surveyed generally do not believe that their applicants are well qualified. Additionally, only 27 percent of survey respondents say that recent graduates in cybersecurity are well-prepared, though 58 percent indicate that they require a degree for entry-level cybersecurity positions.

Respondents note that they also seek prior hands-on cybersecurity experience (95 percent), credentials (89 percent) and hands-on training (81 percent) when determining whether a candidate is qualified.

The top three skills gaps they see in candidates are soft skills (56 percent), security controls (36 percent) and software development (33 percent), which organizations are addressing by:

  • Training non-security staff who are interested in moving to security roles (43 percent)
  • Increasing usage of contract employees or outside contractors (37 percent)
  • Increasing use of reskilling programs (23 percent)
  • Increasing use of performance-based training to build hands-on skill (22 percent)
  • Increasing reliance on AI/automation (22 percent)

Don't miss