Cybersecurity teams continue to struggle with hiring and retention, and very little improvement has been achieved in these areas since last year, according to new global research from ISACA that identifies current workforce challenges and trends in the cybersecurity field.

Part 1 of ISACA’s 2020 State of Cybersecurity report finds that enterprises are short-staffed, have difficulty identifying enough qualified talent for open positions and don’t believe their HR teams adequately understand their hiring needs.

“Cybersecurity jobs are in huge demand but, as many organisations are all too aware, it continues to be a real struggle to find the right candidates with the right skills and experience to meet the demands of these roles,” says retired Brigadier General Greg Touhill, ISACA board director.

“Better understanding the nature of the skills gaps and issues with hiring and retention can help the industry more effectively drive innovative strategies and tactics to address and overcome these long-standing challenges.”

Some key findings include:

• 62 per cent say their organisations’ cybersecurity team is understaffed, and 57 per cent say they currently have unfilled cybersecurity positions on their team.
• 70 per cent say that fewer than half of their cybersecurity applicants are well qualified.
• 72 per cent of cybersecurity professionals believe their HR departments do not regularly understand their needs.
• 58 per cent of respondents anticipate an increase in cybersecurity budgets, an increase of three percentage points from last year, but less than the 64 per cent reported two years ago, signalling that spending may be levelling out.

Finding staff with the right skillsets continues to be difficult for cybersecurity teams. Survey respondents expressed that having a degree does not necessarily indicate that a candidate is ready for the job, with only 27 per cent saying that recent graduates in cybersecurity are well-prepared.

They also indicated that candidates are not measuring up in either technical or soft skills, citing as the top five skills gaps being soft skills (32%), IT knowledge and skills gaps (30%), insufficient business insight (16%), cybersecurity technical experience (13%) and insufficient hands-on training (10%). However, when asked about the factors they consider when determining if a cybersecurity candidate is qualified, they place emphasis on technical skills, ranking the top three qualifications as hands-on cybersecurity experience (95%), credentials (89%) and hands-on training (81%).

Once teams achieve the difficult task of finding the right professionals, they then struggle to retain them, with 66 per cent saying it’s difficult to retain cybersecurity talent, a slight increase from last year. They cite the main reasons for staff leaving as recruitment by other companies (59%), limited promotion and development opportunities (50%), poor financial incentives (50%), high work stress levels (40%, a 10% increase from the year prior) and a lack of management support (39%).

More than 2,000 cybersecurity professionals who hold ISACA’s Certified Information Security Manager (CISM) credential or have information security job titles participated in the online survey. The findings will be issued in two reports in 2020.

For a free download of the first report, visit www.isaca.org/state-of-cybersecurity-2020.