The Basic Facts

As in past years, ESG and ISSA got some baseline information regarding cybersecurity professionals’ careers. For example:

79% of cybersecurity professionals started their careers working in IT.

When asked which skills were most helpful in the move from IT to cybersecurity, the top responses were IT operations knowledge and skills (61%), analytics skills (53%), hands-on technology knowledge and skills (48%), and business skills (as they relate to IT technologies and processes) (42%).

When asked the reasons for becoming a cybersecurity professional, the top responses were the chance to use skills and curiosity to address technical challenges (43%), the opportunity to develop technical skills and knowledge (40%), it being a natural career move from IT (34%), and attraction to the morality of the profession (29%).

28% of survey respondents say that either they or other cybersecurity professionals they know have experienced significant personal issues because of stress associated with the cybersecurity profession (i.e., drug abuse, alcohol abuse, depression, etc.).

50% of cybersecurity professionals surveyed say that job stress levels increased this past year as a result of remote worker support due to the COVID-19 pandemic. To help alleviate stresses caused by the pandemic, 36% of organizations instituted more CISO “check-ins” with staff, 32% created online social meetings for the cybersecurity team, and 24% added formal stress management programs driven by HR.

Survey respondents were also asked whether their organization employed a CISO. Those that did were asked several other related questions. On this topic, the research revealed:

73% of survey respondents say that their organization employs a CISO while 5% say their organization employs a virtual CISO (vCISO).

Of those organizations that employ a CISO, 43% say that the CISO reports to the CIO, 29% say the CISO reports to the CEO, 9% say COO, 9% say “other,” and 10% don’t know.

61% of respondents say their CISO is an active participant with executive management and the board of directors (or similar oversight group), 14% say their CISO is not an active participant with executive management and the board of directors (or similar oversight group), and 24% don’t know. 51% think their organization’s CISO’s level of participation with executive management and the board of directors is adequate, 23% do not think their organization’s CISO’s level of participation with executive management and the board of directors is adequate, and 26% don’t know.

43% believe their CISO has been very effective, 49% believe their CISO has been somewhat effective, 6% say their CISO hasn’t been very effective, and 2% claim their CISO has not been effective at all.

When asked to identify the most important qualities of a successful CISO, 39% said leadership skills while 30% said operational skills. The remaining 31% included business skills, technical skills, management skills, communications skills, and other.

Survey respondents were asked which factors are likeliest to cause CISOs to leave one organization for another. The most popular answers were: CISOs are offered a higher compensation package at another organization (33%), the organization doesn’t have a culture that emphasizes cybersecurity (31%), and cybersecurity budgets are not commensurate with the organization’s size and industry (29%).

Getting a Cybersecurity Job

For the first time, ESG and ISSA asked cybersecurity professionals how they found their current job (see Figure 1). The highest percentage (38%) say that they found their job by networking with industry contacts while 24% were contacted by an industry recruiter and 22% responded to a job posting at their company (see Figure 1). Not surprisingly, there is a slight correlation between methods used for finding a job and seniority. Senior cybersecurity professionals are more likely to find their jobs through industry contacts and recruiters while those with less experience are more likely to use job postings. This information should help guide CISOs and HR professionals as they compete to fill job requisitions.

Despite the ongoing cybersecurity skills shortage, skilled candidates often complain that it can be very difficult to begin a cybersecurity career. When meeting entry-level candidates, ESG analysts and ISSA members are often asked for advice in this area. In 2021, ESG and ISSA addressed this issue directly by including a new survey question asking survey respondents for their recommendations for those seeking to enter the cybersecurity field. Nearly half (49%) of respondents suggested getting a basic cybersecurity certification, 42% proposed joining a professional industry organization, and 36% recommended finding a mentor who is willing to help develop skills and career plan (see Figure 2). This guidance will hopefully help entry-level candidates jumpstart their careers.

Cybersecurity Careers Depend upon Hands-on Experience and Some Certifications

Cybersecurity is highlighted by a plethora of esoteric technical certifications, so ESG and ISSA have continually asked survey respondents to tell us which certifications they’ve achieved, and which are most important. As in past years, survey respondents were asked to write in the answer to this question, and the top responses are listed in Figure 3. Of those certifications achieved, the most useful ones for getting a job are graphed in Figure 4 . In both graphics, the certified information systems security professional (CISSP) from (ISC)2 stands out—it’s the most popular certification and the one that’s most important for getting a cybersecurity job. Other certifications may be important tactically but should be viewed as vehicles for career advancement (in some cases) or to help cybersecurity professionals gain general knowledge in a cybersecurity subdiscipline (for example, certified ethical hacker).

Cybersecurity professionals pursue a CISSP certification after accruing the requisite number of years of experience as this certification is a requirement for most available jobs. Beyond the CISSP, however, survey respondents take a more tactical approach to additional certifications based upon their skills, interests, and career plans. ESG and ISSA believe this is the right approach for certifications and career development. Rather than fill their resumes with acronyms, cybersecurity professionals should focus on hands-on training, mentoring, and professional networking as primary means for skills development. Rather, certifications should supplement these activities.

ESG and ISSA have long held the belief that hands-on experience is the most important factor in cybersecurity career development, but this assumption was based on anecdotal data. In 2021, ESG and ISSA tested the hypothesis in the survey.

The data supports this long-held belief again. Only 1% of respondents believe security certifications are more important than hands-on experience. Alternatively, 52% believe that hands-on experience is more important than certifications while 46% place equal value on hands-on experience and certification achievement (see Figure 5). Based on the research, ESG and ISSA believe that those who believe that hands-on experience and achieving security certifications are equally important have the CISSP certification in mind, as this is considered a foundational requirement for a cybersecurity career.

Based upon this data, aspiring and advancing cybersecurity professionals should take a balanced approach to skills development. As previously stated, hands-on experience should be supplemented with the appropriate security certifications on an as-needed basis.

Cybersecurity Professionals: A 360 Degree View

What are the most important factors that distinguish a satisfactory and unsatisfactory cybersecurity job? This question has been a constant in the ESG/ISSA research study for five years. Interestingly, the results have been fairly consistent. The top three priorities in 2021 are business management’s commitment to strong cybersecurity, competitive or industry-leading financial compensation, and the ability to work with highly skilled and talented cybersecurity staff (see Figure 6).

CISOs and HR executives take note, as this data represents what it will take to hire and retain cybersecurity professionals.

With job satisfaction in mind, ESG and ISSA also wanted insight into the most stressful aspects of a cybersecurity job. Nearly two-thirds (32%) of survey respondents claim it is finding out about IT/initiatives/projects that were started by other teams (within the organization) with no security oversight (see Figure 7). This makes sense. Security professionals want to be engaged in projects from the start so they can “bake in” rather than “bolt on” security. Similarly, nearly one-third (31%) of respondents believe it is stressful working with disinterested business managers while another 31% point to the overwhelming workload. Similar to the top response, 24% of security professionals believe it is stressful keeping up with the security needs of new IT initiatives. Clearly, cybersecurity professionals want to be involved in projects from the start and want to see cybersecurity commitment from business and IT associates. When these conditions are absent, organizations will likely face high employee burnout and staff attrition.

As in the past, security professionals were asked their opinions on several topics (see Figure 8). A few stats stand out:

Conflict between the need for training and time allocated to training remains a critical issue: 91% of respondents agree that cybersecurity professionals must keep up with their skills or their organizations are at a significant disadvantage, yet 59% agree that while they try to keep up on cybersecurity skills, it is hard to do given the demands of their jobs. ESG and ISSA call this situation the cybersecurity training paradox. CISOs take note and make sure to convince the organization that ample training time and resources are an absolute requirement.

Cybersecurity professionals tend to pride themselves on their endurance and competitiveness, masking the personal price these jobs can have. The research supports this as 60% agree that a cybersecurity career can be taxing on one’s work/life balance, and 38% agree that they often feel an unhealthy level of stress with their jobs. Accordingly, CISOs should constantly monitor the mental health of team members while establishing programs for stress relief.

58% of survey respondents agree that security professionals spend too much time on the technical aspects of cybersecurity and not enough time on how cybersecurity aligns with the corporate mission. ESG and ISSA believe this is a fundamental industry dilemma, sometimes called the “shiny object problem.” To address this, CISOs must always reinforce the business focus of cybersecurity within the security team.

Interestingly, despite the personal challenges represented in this data, 79% of cybersecurity professionals agree that they are happy as cybersecurity professionals. ESG and ISSA believe that this commitment to the mission regardless of the challenges is what makes cybersecurity professionals special. Rather than business or technical professionals, cybersecurity professionals behave like dedicated public servants, with a focus tilting toward the greater good rather than personal accolades.

In another opinion question, survey respondents were asked how long it takes a cybersecurity professional to become proficient at their job. The plurality of respondents (35%) believe it takes anywhere from 3 to 5 years to develop real cybersecurity proficiency, while 25% say 2 to 3 years and 17% claim it takes more than 5 years (see Figure 9). Three to 5 years is a long time. CISOs should do everything they can to accelerate staff skills development and retain employees with this level of experience.

It is often said that cybersecurity is a “team sport.” In other words, an organization’s cybersecurity program success goes beyond the information security team alone and depends upon commitment and cooperation across the entire organization. With this collaborative ideal in mind, survey respondents were asked to characterize the working relationship between their organization’s cybersecurity team and other departments (see Figure 10). The data indicates that the best relationships are with IT, executives, legal, and operations teams, but ESG and ISSA believe a few points are noteworthy:

16% of respondents said the relationship between security and IT teams is fair or poor. This is somewhat alarming since these teams must work together constantly on tasks like technology deployment, configuration management, and risk mitigation.

21% of respondents said the relationship between security and executives was fair or poor. Similarly, 27% said the relationship between security and the board of directors was fair or poor. These are likely organizations that still believe that security is related to technology and not the business. It’s likely that these firms still equate security with regulatory compliance.

29% of respondents said the relationship between security and HR was fair or poor. This is of concern since the two groups work together on projects like security awareness training, recruitment, and hiring. These tasks are probably managed sub-optimally at organizations with fair or poor security/HR working relationships.

What can organizations do to improve some of these relationships? Survey respondents were asked this question directly about the relationships between security, IT, and business management teams. With regard to improving the security/IT relationship, security professionals suggest making sure security staff is included in all IT projects from the beginning, embedding cybersecurity staff within functional technology groups, and increasing cybersecurity training for all IT staff (see Figure 11).

These suggestions are especially interesting. Recall that the most stressful aspect of a security job identified previously relates to IT projects/initiatives lacking security oversight. Alleviating this issue will not only decrease employee stress but also improve the working relationship between security and IT as well as overall security protection. Embedding cybersecurity staff members into functional technology groups is happening with activities such as DevSecOps focused on cloud-native application development. Along with additional security training (especially for software developers), organizations are fusing security into more aspects of IT people, processes, and technologies.

In terms of the relationship between security and business management, survey respondents suggest encouraging cybersecurity participation in business planning and strategy, improving cyber-risk identification/quantification, and focusing cybersecurity resources and investments on business-critical assets (see Figure 12). Like the IT relationship, cybersecurity pros believe that working closer and earlier with business teams can be beneficial. As this happens, security teams must be prepared with the right communications, reports, and metrics that present cybersecurity in a business context.

The Cybersecurity Skills Shortage Persists, and in Many Cases, Continues to Worsen

ESG and ISSA believe the cybersecurity skills shortage has two major implications. The most obvious is a shortage of talented cybersecurity professionals, with simply more cybersecurity job openings than qualified candidates to fill them. The other implication isn’t as widely discussed but is at least as important: Many members of the current cybersecurity workforce lack the advanced skills necessary to safeguard critical business assets or counteract sophisticated cyber-adversaries.

After researching the cybersecurity skills shortage for five years, ESG and ISSA are convinced that it is real and impactful, yet each report on the subject receives a fair amount of negative feedback, questioning its existence. Comments include theories that there are plenty of cybersecurity professionals to go around, if only organizations knew how and where to recruit them.

Based on this feedback, ESG and ISSA asked survey respondents a basic question in the 2021 survey: Has the cybersecurity skills shortage been overstated? As it turns out, one-third of respondents share the opinion that the skills shortage has been greatly or somewhat overstated, but the highest percentage of cybersecurity professionals (44%) believe it has received the right amount of attention, while 23% claim it has been understated (see Figure 13).

As further research clearly indicates, the cybersecurity skills shortage is real, leading to lots of problems for organizations. At the same time however, the research points to the fact that some organizations may be experiencing self-inflicted wounds and truly don’t recruit well, provide the right level of training, or address the skills shortage with the right strategies. In essence, both groups are right: The skills shortage is real, but organizations could and should be doing more.

As in past years, ESG and ISSA wanted to understand the implications of the global cybersecurity skills shortage and how it is affecting organizations. For the first time, the data improved slightly. This year, 57% of organizations claim they’ve been impacted by the cybersecurity skills shortage, compared to 70% in 2020 and 73% in 2019 (see Figure 14).

While this data point seems to represent an encouraging trend, additional data paints a different picture. Last year, ESG and ISSA added a question asking cybersecurity professionals whether they believe the cybersecurity skills shortage is improving or getting worse. This year’s results are distressing as 44% believe the cybersecurity skills shortage (and its impact) have gotten worse over the past few years while 51% say it’s about the same today as it was over the past few years (see Figure 15). Sadly, only 5% believe the situation has gotten better.

Based upon years of research, ESG and ISSA firmly believe that the cybersecurity skills shortage is a long-term reality where the industry has achieved little progress. While education and recruitment programs may be worthwhile, CISOs must craft enterprise security programs that accommodate and plan for perpetual skills shortages.

As in the past, survey respondents working at organizations impacted by the cybersecurity skills shortage were asked about the ramifications experienced (see Figure 16). Once again, the top response (62%) was that it has increased the workload on existing staff (similar to last year’s results, 58%). This is the biggest consequence of the skills shortage by far. Additionally, 38% of respondents indicated that the skills shortage has led to new security jobs remaining open for weeks or months (this may be one reason why 29% of organizations must hire and train junior employees rather than experienced candidates). Consistent with the mental health theme described previously, 38% of respondents said that the skills shortage has led to employee burnout and employee attrition.

It is also noteworthy that one-third of respondents say that the skills shortage has led to a situation where the cybersecurity team is unable to learn or utilize some security technologies to their full potential. Think about that for a moment: Organizations determine they need some new security technology for threat prevention, detection, or response. They go through the rigor of researching, purchasing, testing, configuring, deploying, and operating the product as well as training staff. After all this work, they still lack the staff or skills to operate the product correctly. Given this situation, CISOs must reassess their priorities, only purchasing technologies that can be used appropriately. In other cases, organizations should consider managed services as an alternative to underutilized security technologies.

For the first time, organizations claiming to be impacted by the cybersecurity skills shortage were asked to identify contributing factors. The three top responses included issues related to compensation, HR’s understanding of cybersecurity skills, and working in an industry that may be unattractive to cybersecurity professionals (see Figure 17). It is also worth noting that 25% pointed to unrealistic job postings (i.e., asking for skills that were not commensurate with compensation offered, real job requirements, etc.). To some extent, this data supports the theory that the cybersecurity skills shortage is related to mismanagement rather than a dearth of qualified candidates or advanced skills.

Compensation is a binary issue—either an organization offers competitive compensation, or it does not. The same could be said of an organization’s industry. If compensation or industry is unappealing, the hiring company is at a distinct disadvantage and will only be successful at recruiting if other job attributes are especially attractive (i.e., working hours, training opportunities, benefits, etc.). With regard to compensation, CISOs must lobby HR, finance, and other departments to offer competitive salaries, or they face a perpetual losing battle for staff recruitment and retention. As for other factors mentioned, CISOs must ensure that HR departments and recruiters are well versed in cybersecurity needs and put together accurate and realistic job postings as part of their recruitment process.

Additional data from this year’s survey results add further evidence to the extent of the cybersecurity skills shortage. According to Figure 18, when asked how difficult it is to recruit cybersecurity professionals, 76% of security professionals say it is either extremely (18%) or somewhat difficult (58%).

Survey respondents were asked to identify areas with the most acute skills shortages. Nearly four in ten (39%) cite cloud computing security, followed by nearly a third (30%) who identify application security and/or security analysis and investigations as areas of personnel deficiency (see  Figure 19).

CISOs must understand the level of competition for candidates with these skill sets. It may be worthwhile to craft backup plans if recruitment efforts languish or fail completely. Examples include training software developers and DevOps personnel on application security, recruiting and training server virtualization administrators as cloud computing security specialists, and working with experienced managed services providers.

The research also points out that it is most difficult to recruit mid-career and senior cybersecurity professionals while fewer organizations have trouble recruiting entry-level security staff or cybersecurity leadership (see Figure 20).

While organizations find it difficult to recruit and hire cybersecurity staff, security professionals are constantly being recruited for new positions with promises of higher pay, better benefits, and an assortment of perks. In fact, 70% of the cybersecurity professionals surveyed are solicited to consider other job opportunities at least once per month (see Figure 21). Furthermore, 71% of survey respondents believe that the frequency/volume of job solicitations has increased over the past few years. Cybersecurity truly remains a seller’s market.

In 2021, survey respondents were once again asked to identify who is responsible for addressing the cybersecurity skills shortage. Respondents indicate that CISOs/CSOs really own this problem (see Figure 22). Are these individuals and the organizations they work for doing enough to address the cybersecurity skills shortage? Not according to survey respondents, as 27% believe their organization could be doing somewhat more to address the skills shortage while nearly one-third (32%) say their organizations could be doing much more here (see Figure 23).

As previously stated, this data reinforces the need for CISOs/CSOs and the organizations they work for to plan for staff and skills shortages by including plans for additional use of professional/managed services and process automation. Organizations should also research, test, and pilot “smart” security solutions based on advanced analytics. These technologies vary widely in terms of efficacy and should be approached cautiously, but their potential to augment human skills in the future is worth pursuing.

With most respondents believing that their organizations could do more to address the skills shortage, ESG and ISSA asked them for some specific recommendations (see Figure 24). Cybersecurity professionals suggested actions like increasing the commitment to cybersecurity training, increasing compensation, providing additional perks, and creating or improving a cybersecurity internship program.

The top three recommendations are clear; organizations need to offer competitive compensation, benefits, and training opportunities to attract top cybersecurity talent. Aside from these basics, survey respondents have some additional advice such as looking beyond security and IT for talent, working more closely with cybersecurity professional organizations, and increasing work with local colleges and universities. In summary, successful cybersecurity recruiting requires a bit of experimentation and creativity. Organizations should take chances with the goal of creating programs that are attractive to the cybersecurity community. CISOs should gather further feedback and enlist the HR department’s help to create this type of environment.