Decoding the talent gap in info-security

Summary

The gap in cybersecurity talent management has become impossible to ignore, and closing it requires more than posting more job openings. Macro-level workforce data and industry surveys point to the tangible factors behind the shortage of skilled security professionals, and why in-house hiring and management of a security function is becoming steadily harder for organizations of every size.

The skills shortage bites hardest across specialties such as cloud security, application security, and security analysis and investigations, and training gaps within existing teams compound the shortage of new hires. A persistent lack of diversity across gender and ethnicity within cybersecurity roles also shapes the shortage, as a narrow talent pool constrains the industry's ability to scale.

Beyond staffing numbers, structural issues inside organizations compound the gap: the erosion of the security function's authority as chief security officers lose gatekeeping power to growth priorities, and a persistent mismatch between security's seniority in the org chart and its actual responsibility. Security aggregators, firms that consolidate end-to-end security needs into a single curated package, offer a possible alternative to building an in-house team from scratch.

• Covers hiring, training, diversity, and organizational authority as distinct dimensions of the talent gap
• Weighs in-house security teams against outsourced security aggregators as competing models

Should businesses stick to traditional in-house security, or is there a better way forward?