The cybersecurity skills gap has been plaguing enterprises for years—but despite garnering much discussion and media coverage, little progress is being made. On top of that challenge, cyberattacks continue to increase—and are often underreported.
State of Cybersecurity 2020 looks at questions such as:
- How long does it take to fill a cybersecurity role with a qualified candidate?
- Which cybersecurity skills are in the highest demand?
- Are HR teams informed partners in the search for qualified cybersecurity candidates?
- Are cybersecurity teams becoming more gender-balanced, and are diversity programs doing enough to help?
- What can companies do to staff up more quickly and find better-qualified candidates?
- Which attacks are most common?
- Are machine learning and AI widely used as security tools?
Find answers to all of these and more by viewing the complimentary report, infographic and blog post below.
STATE OF CYBER PART 2: THREAT LANDSCAPE AND SECURITY PRACTICES

News Release
New Research from ISACA Reveals That Organizations with Unfilled Cybersecurity Roles Suffer More Attacks
See the Latest
CYBER PART 1: WORKFORCE AND RESOURCES

Report
State of Cybersecurity 2020, Part 1: Global Update on Workforce Efforts and Resources
Read the Report

News Release
ISACA’s Cybersecurity Study Reveals Struggles with Hiring and Retention Persist, More Diversity Progress Needed
See the Latest
EXPERT INSIGHTS
Partner With Universities
“There is a real opportunity for trade organizations and trade schools to help train the skilled cybersecurity workforce of tomorrow. Partnerships with universities as well as high schools are imperative to build a pipeline of job-ready cybersecurity professionals.”- Melody Balcet, CISM, CISSP, Immediate Past-President, ISACA Greater Washington D.C. Chapter, and Director, Global Cybersecurity Program, The AES Corporation
Remove the Stereotypes and Encourage Young People
“We are witnessing a real war of talents, yet even though this is a booming sector, as our society is rapidly digitalizing with an equally spectacular increase in cyberthreats, we are sorely lacking profiles to support companies and administrations in their protection. This problem is even more acute in public administrations, which cannot offer the same type of salary as the private sector. Yet the situation is not so desperate: action can be taken.
Let's encourage our young people to take up cyber courses, offering quality education. Let's also get away from the caricatured image of the geek in a hoodie. Let's show that cybersecurity is not only about technology, but also about (crisis) communication, risk management, diplomacy, geo-politics, psychology and more. Let's turn to women, who offer an extraordinary and under-exploited pool of valuable skills for any organization, and let's take care of our precious resources: let's train them. Let's give them the opportunity to take part in this noble mission: to make cyberspace safer and more reliable.”
- Phédra Clouner, CISM, Deputy Director, Centre for Cybersecurity Belgium
Alter Your Hiring Practices
“We need to do more during the hiring process to ensure enough women are interviewed, by looking at nontraditional recruiting methods and going one step further than reactively looking through applications. As an industry, we should focus more on building the right messaging for women, speaking with them, understanding their needs, and encouraging them. We should particularly be giving them the confidence to apply for the more senior positions, which are predominantly taken by men and result in having a lack of female leaders/role models in the industry. We can’t expect things to change if we don’t alter our hiring methods.”- Charlotte Osborne, Senior Consultant, Cyber Security, Preacta Recruitment
Hire Motivated Candidates and Train Them for Technical Skills
“Finding a talented and well-prepared cybersecurity employee is a difficult process, and it can be especially challenging to address the underrepresentation of women on our teams and in the field. The ideal talent has a strong baseline knowledge in IT and is also able to understand business needs from an IT security perspective. I have always preferred to hire new graduates and teach them on these soft and technical skills through mentorship programs. I believe the time commitment is worthwhile. You should hire employees not just according to their actual knowledge and experience, but their motivation, and then provide them tools, training and space to grow.”- Andrea Zengő, CISA, CISM, CISSP, CEH, Global CISO for Transcom




