April 24, 2017 By Douglas Bonderud 2 min read

The cybersecurity skills gap is widening. IT governance firm ISACA estimated a global shortage of 2 million security experts by 2019. Already, more than 40,000 IT security jobs are left unstaffed in the U.S. every year, even as companies look for ways to increase compensation, improve benefits and bring in new hires, explained Cyberseek.

Part of the problem? Even with universities and private training firms increasing the variety and volume of offered security courses, the market simply can’t keep up with continuing data breaches and evolving malware. More potential hires are looking to build out their resume with cyber experience — but how do companies ensure new recruits have the abilities to match their application accolades?

Testing, Certification and More

Certification programs now exist for a host of cybersecurity skills, but extending an offer to new hires based on classroom skills alone is a risky bet: Associations Now chronicled that 37 percent of companies surveyed said less than one-quarter of all applicants were actually qualified to take on organizational security roles.

To both address the cybersecurity skills gap and help companies identify the best candidates, ISACA developed a new toolset — known as the CSX Training Platform — that challenges prospective security pros with complex scenarios and live incidents to manage.

Of most interest to corporate HR departments and IT admins who need to onboard new staff is the platform’s two-hour assessment tool, which includes “a real firewall, a real DMZ, a real web server, a real database server, whatever the configuration happens to be,” Frank Schettini, ISACA chief innovation officer, told Associations Now.

As a result, HR and IT are able to quickly and easily determine a potential candidate’s ability to handle cybersecurity issues in real time, with a tool that effectively mimics actual attacks or outages. In addition, the platform is accessible anywhere and from any device, allowing managers to easily asses new hires, monitor training progress, and even enable experience staff to log in and improve their cybersecurity skills.


Long-Term Strategy for the Skills Gap

While ISACA’s new testing tool helps identify ideal cybersecurity candidates, it can’t magically create new security experts to reduce the skills gap at large.

Addressing that challenge requires a two-pronged effort: Many post-secondary schools are now adopting security-focused IT tracks that give students critical training in real-world security management, and the development of advanced AI and automation tools are bolstering corporate ranks, allowing current security experts to embrace specificity in their roles. While it’s unlikely that cybersecurity cyborgs will ever take the place of human experts, why should companies waste time and effort on straightforward functions such as data collection, aggregation and reporting?

The cybersecurity skills gap isn’t going away — right now, companies and post-secondary institutions are playing catch up to fill vacant positions and address the increasing risk of network breaches. ISACA’s new tool is a critical stopgap: A way for HR teams to ensure that new security hires can both talk the talk and walk the walk when it comes to defending corporate IT interests.

More from

ONCD releases 2024 Report on the Cybersecurity Posture of the U.S.

4 min read - On May 7, the Office of the National Cyber Director (ONCD) released the 2024 Report on the Cybersecurity Posture of the United States. This new document is a report card on how well cyber policy followed the guidelines set by the National Cybersecurity Strategy, introduced in March 2023. Here’s what you need to know about the newly released report. Fundamental shifts in cyber roles Over the past year, the U.S. national cybersecurity posture was driven by the 2023 National Cybersecurity…

CISA wants private industry to publicly commit to Secure by Design

4 min read - The tech industry has the power to protect the world from nation-state threat attacks, cyber crime and those wanting to compromise data and manipulate critical infrastructure. But with this power comes great responsibility, which, to be honest, the tech industry has not been that interested in holding. But at the RSA Conference (RSAC) in San Francisco, the cybersecurity and tech communities took steps to exert some power and take responsibility. They took the Secure by Design pledge, a promise to…

Change Healthcare discloses $22M ransomware payment

3 min read - UnitedHealth Group CEO Andrew Witty found himself answering questions in front of Congress on May 1 regarding the Change Healthcare ransomware attack that occurred in February. During the hearing, he admitted that his organization paid the attacker's ransomware request. It has been reported that the hacker organization BlackCat, also known as ALPHV, received a payment of $22 million via Bitcoin.Even though they made the ransomware payment, Witty shared that Change Healthcare did not get its data back. This is a…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today