We are all aware of the significance of cybersecurity sector and how it is short of vacancies and skills. It is yet unfortunate that their may not be an immediate relief, research firm Gartner's estimates come true that a full quarter of security leaders completely leave the cybersecurity industry by 2025.
The new report suggests that almost half of the cybersecurity experts will end up switching their professions, and that by year 2025, lack of skills and human failure would ultimately be the reason for over half of significant cyber incidents in the coming future.
Do Not Ask Cyber Staffers “Why So Serious”?
According to Deepti Gopal, director analyst at Gartner, professionals who are currently leading in the field of cybersecurity are in fact burning the candle at both ends to balance technology, business and environmental requirements in an attempt to maintain and improve their firm’s security.
“While they are in the rush to achieve this they are really spread thin[…]If you look closely at today’s world, the hybrid work environment is everything; that also impacts the cybersecurity leaders, adding complexity to their work and the way they strategize,” she says.
The "work life harmonization" employed by IT, she continued, dissolves the line separating work and non-work, especially given that both are located in the same place.
“If you listen to cybersecurity leaders, you’ll hear things like ‘I start my day with work, emails, alerts, and coffee,’ and ‘I work with a group of All Stars who are always available, they don’t complain about the workload. These are all elements that indicate the presence of high stress, high demand,” Gopal said.
“But, there is a loss of control or inability to have a sense of control on their work-related stress — the inability to protect their time for the things that matter the most. I like to ask leaders to jot down the things that they absolutely do in the coming week and then look at their calendars, most often they tell me that they haven’t carved out any time for the tasks on their list!” she adds.
Cybersecurity Teams Undervalued at Companies That Move Fast and Break Things
Gartner research illustrates how the compliance-based cybersecurity programs, low executive support and subpar industry-level security are all signs that a company does not consider security risk management to be essential for commercial success.
According to Gopal, such enterprises are likely to lose cybersecurity talent to businesses where they are valued and are better recognized. “When the organization is charged to move fast, there will be situations where security is not top of mind; that needs to change,” Gopal said. “We need to see cybersecurity as intrinsic to digital design.”
With Rise in Insider Risk, Talent Continues to Plunge
According to Paul Furtado, vice president analyst at Gartner, the 'talent churn' of cybersecurity professionals as well as other professionals in the IT industry is a security risk since it gives rise to the possibility of insider misconduct.
“The cybersecurity workforce is a microcosm of society and made up of individuals who respond differently to different stress triggers[…]For some, they will leave their employment gracefully without any disruptions,” Furtado said. “Others may feel that the artifacts they’ve created or contributed to are their personal intellectual property, and therefore, they take a copy. Some may feel that they want to exfiltrate some data that may assist them in their next role with a different employer,” he continues.
Moreover, there also exists a possibility that individuals may well attempt actions, beyond theft to commit acts of sabotage or complete disruption of system or data, regardless of the position they hold in an organization.
“The reality is that security leaders must be prepared for each of these occurrences; there are numerous examples where these behaviors have occurred[…]The scary part: In some cases, insiders won’t wait for a layoff or resignation to start some of these behaviors,” Furtado says.
Furtado further advises that an organization must be well prepared against insider risks, since it is critical to prevent it from becoming an ‘actual insider threat event.’