Sophisticated cybersecurity defenses are increasingly in high demand as a cybersecurity attack is now viewed as an inevitability. However, a majority of surveyed organizational leaders fear they are ill-equipped to address these threats head-on.

ISACA's State of Cyber Security Study 2017 shows that the cybersecurity skills gap persists, with many companies saying it can take six months or more to fill positions – and a significant percentage saying they can't fill them at all.

According to a new cyber security workforce study by ISACA's Cybersecurity Nexus (CSX), only 59 percent of surveyed organizations say they receive at least five applications for each cybersecurity opening and only 13 percent receive 20 or more. In contrast, studies show most corporate job openings result in 60 to 250 applicants. Compounding the problem, ISACA's State of Cyber Security 2017 found that 37 percent of respondents say fewer than one in four candidates have the qualifications employers need to keep companies secure.

"Though the field of cybersecurity is still relatively young, demand continues to skyrocket and will only continue to grow in the coming years," said Christos Dimitriadis, ISACA board chair and group director of Information Security for INTRALOT. "As enterprises invest more resources to protect data, the challenge they face is finding top-flight security practitioners who have the skills needed to do the job. When positions go unfilled, organizations have a higher exposure to potential cyberattacks. It's a race against the clock."

More than one in four companies report that the time to fill priority cybersecurity and information security positions can be six months or longer. In Europe, almost one-third of cyber security job openings remain unfilled.

Cybersecurity Qualifications: A Moving Target

Most job applicants do not have the hands-on experience or the certifications needed to combat today's corporate hackers, according to the report by the global technology association.

"The survey underscores a fundamental disconnect between employer expectations and what candidates can actually bring to the table," said Matt Loeb, ISACA CEO. "Employers are looking for candidates to make up for lost time but that doesn't necessarily mean a significant academic investment. Many organizations place more weight in real-world experience and performance-based certifications and training that require far less time than a full degree program."

ISACA's report highlighted where hiring managers' expectations are shifting most as they consider candidates for open cybersecurity positions:

  • 55 percent of respondents report that practical, hands-on experience is the most important cybersecurity qualification.
  • 25 percent say today's cybersecurity candidates are lacking in technical skills.
  • 45 percent don't believe most applicants understand the business of cybersecurity.
  • 69 percent indicate that their organizations typically require a security certification for open positions.

Closing the Gap

ISACA offers five recommendations to help find and retain qualified cyber security talent:

  1. Invest in performance-based mechanisms for hiring and retention.
  2. Create a culture of talent maximization to retain the staff you have. Even when budgets are tight, there are things that can be done that don't impact the bottom line: Alternative work arrangements, investment in personnel growth and technical competency and job rotation to help round out skills.
  3. Groom employees with tangential skills – such as application specialists and network specialists – to move into cybersecurity positions. They are likely to be highly incented to do so and it can help fill the gap in the long term.
  4. Engage with and cultivate students and career changers (e.g., an outreach program to a university or an internship program).
  5. Automate basic security operational tasks to decrease the overall burden on staff.

Download a free copy of the workforce report at

More In Cyber