According to Tim Erlin, Tripwire’s vice president of product management and strategy, among the key findings was the surprising 93 percent of security professionals who are “concerned about the cybersecurity skills gap.” This “gap” is having a real impact in the workplace, as the study also found that 72 percent of respondents believe it is harder to hire qualified security staff to defend against today’s sophisticated cyberattacks than it was two years ago.

The study also identified some of the reasons.

An overwhelming majority of respondents (81 percent) said that the skills needed to become an excellent security professional have changed over the past few years.

In a recent blog post on the company’s “State of Security,” Erlin commented on the growing impact of how the changing nature of security threat defense has changed the skills required. Clearly, security teams are evolving and maturing along with the rest of the cybersecurity industry, but the number of qualified staff and the training available simply aren’t keeping up.

For example, in addition to their technical duties, security professionals can now be expected to spend more time in the boardroom or the CFO’s office to secure a bigger budget. While the cybersecurity workforce may be changing, the fundamentals of protecting an organization remain the same.

According to the survey, finding professionals with strong cybersecurity skills creates challenges and even forces some companies to make difficult decisions. The study found that one major trend is that cybersecurity is becoming much more of a team effort.

Security teams shouldn’t overburden themselves by trying to do everything on their own. They can work with trusted managed service providers or sign up for service plans in which outside experts can act as an extension of the team.

“Security is a shared responsibility across different functions. People from other parts of the business need to be involved in the cybersecurity program. And, of course, automation can add value not only by reducing manual work, but also by ensuring everything is up to date and running properly in real time. The security team may simply need to work more creatively.”


In fact, the study found that companies are developing several strategies to keep future skills shortages at bay.

Among the findings:

  • 98 % expect other functions, such as non-security teams, to be more involved in cybersecurity in the future.
  • 96% percent believe automation will play a role in addressing future skills shortages.
  • 91% plan to supplement their team by outsourcing skills.
  • 88% believe managed services will help address the skills shortage.

But even as companies increasingly focus on expanding their teams to combat security threats, they also know they need to use other strategies to broaden their access to cybersecurity expertise. On that front, half of respondents (50 percent) said they plan to invest more in training their existing staff to help with the looming skills shortage, the study found.

Meanwhile, since additional training takes time to pay off, 20 percent of organizations hired people without security experience over the past two years, and another 17 percent plan to do the same over the next two years.

The Tripwire/Dimensional Research survey included 315 IT security professionals from U.S. companies with more than 100 employees.