IT security teams are facing a serious labor shortage, which risks compromising their organizations’ security postures. According to a recent study by Kaspersky, 41% of companies are fielding cybersecurity teams that are “somewhat” or “significantly” understaffed, with specialist roles like malware analysis and information security research going empty most often.
In an unnerving revelation, government organizations reported the highest demand for infosec professionals, with almost half of all positions unfilled. Even financial services companies, which show the lowest staffing issues, have only three-quarters of the hires that they’re aiming for.
These figures would be concerning in any circumstances, but they are particularly worrying in today’s threat landscape. Cyber attacks are rising, AI is making attacks more sophisticated, and Ransomware-as-a-Service is expanding the attack vector. Against this backdrop, Gartner’s prediction that lack of talent or human failure will be responsible for more than half of all significant cyber incidents by 2025 sounds highly ominous.
With so much at stake, organizations are racing to fill skills gaps and to upskill existing employees so they can fill in-demand positions. But ultimately, skilled labor is a finite resource. We’ve gathered four practical steps that CISOs can take to harden their security postures in threatening circumstances.
Outsource Tasks to Managed Security Services
Even if you have filled all your infosec positions, you might still struggle to find employees who are skilled in all the relevant subdomains. One option is to outsource challenging activities to managed security providers like Secureworks’s managed XDR service, which uses advanced tech on your behalf to identify threats across attack vectors and endpoints.
Cyber service companies are staffed with experts who focus on specific areas of information security. They keep themselves updated about emerging threats, and because they carry out specialist tasks on a regular basis, they are familiar with uncommon challenges and the best ways to handle them.
Most organizations can’t maintain this level of proficiency, so it makes sense to draw on managed security services’ reservoir of expertise to fill your skills gaps.
However, it’s not a good idea to replace your entire infosec team with outsourced professionals. You still need an in-house cybersecurity team that has intimate knowledge of your systems and business priorities. Managed security services should be used only for specialist issues.
Adopt Cyber GRC Automation
Alongside outsourcing to expert professionals, you can also delegate to automated specialty tools. Cypago, for example, allows companies to automate cyber GRC processes, particularly tedious, time-consuming, but important tasks like compliance framework evidence collection and user access reviews (UAR).
This way, you free up time for your experienced infosec employees, and reduce the burden on them to help prevent burnout.
Cypago offers comprehensive continuous control monitoring and automated evidence collection, which together enable better compliance. This greater visibility gives security stakeholders more time to assess risks and decide how best to address them. Cybersecurity professionals can also apply Cypago’s AI-powered intelligent automatic remediation engine to address security posture gaps, for faster response times and more resilient systems.
Automated gap analysis directs them to the weakest point in the ecosystem, so that they can apply their limited resources to the areas that need it most. Additionally, Cypago’s risk analysis matrix helps identify the most serious threats, so you can allocate resources in a more efficient and effective manner.
Spread the Security Burden
It’s not possible to replace a highly-skilled cybersecurity expert with a sales employee who’s watched a few videos with cybersecurity tips. But you can ease the pressure on your infosec professionals by ensuring that all your employees receive basic cybersecurity training.
It makes a difference when you have a cadre of workers who are trained to recognize security threats like phishing and malware, and know how to carry out simple tasks like patching and upgrading programs. This way, your cybersecurity teams have more time to carry out complex tasks.
What’s more, when your workforce is better at recognizing and preventing attacks, your cybersecurity people will have fewer fires to extinguish.
To achieve this, you might need to up your commitment to cybersecurity training. It’s not enough to run a yearly certification; you need to train employees on a regular basis. It’s also best to use modern training solutions as well as traditional frontal learning. Realistic simulations like those offered by Cofense test your employees capabilities in real-world situations, enabling active learning that drives higher memory retention.
Set Anomaly Detection and Response to Automatic
Automation is a useful strategy for dealing with many kinds of infosec tasks, including threat intelligence coordination, case management, vulnerability assessments, automated enrichment for remediation, threat hunting, and incident response.
Automating processes makes them far more efficient and less error-prone than carrying them out manually, as well as releasing your skilled employees for higher-level work.
According to Splunk’s State of Security 2023 report, 97% of security teams that used an automation tool said that it enabled them to handle a bigger workload with the same size workforce.
Smart Tactics Support Better Security, Even with a Smaller Workforce
The serious lack of skilled infosec employees is concerning, but panic helps no one. At the same time as hunting for infosec talent, you can defend your business from cyber threats by getting more strategic with resources. The right combination of tools, outsourcing, and training can create a web of cybersecurity protection that keeps your organization safe from malicious actors and opportunistic hackers.