The cybersecurity skills gap is widening. IT governance firm ISACA estimated a global shortage of 2 million security experts by 2019. Already, more than 40,000 IT security jobs are left unstaffed in the U.S. every year, even as companies look for ways to increase compensation, improve benefits and bring in new hires, explained Cyberseek.

Part of the problem? Even with universities and private training firms increasing the variety and volume of offered security courses, the market simply can’t keep up with continuing data breaches and evolving malware. More potential hires are looking to build out their resume with cyber experience — but how do companies ensure new recruits have the abilities to match their application accolades?

Testing, Certification and More

Certification programs now exist for a host of cybersecurity skills, but extending an offer to new hires based on classroom skills alone is a risky bet: Associations Now chronicled that 37 percent of companies surveyed said less than one-quarter of all applicants were actually qualified to take on organizational security roles.

To both address the cybersecurity skills gap and help companies identify the best candidates, ISACA developed a new toolset — known as the CSX Training Platform — that challenges prospective security pros with complex scenarios and live incidents to manage.

Of most interest to corporate HR departments and IT admins who need to onboard new staff is the platform’s two-hour assessment tool, which includes “a real firewall, a real DMZ, a real web server, a real database server, whatever the configuration happens to be,” Frank Schettini, ISACA chief innovation officer, told Associations Now.

As a result, HR and IT are able to quickly and easily determine a potential candidate’s ability to handle cybersecurity issues in real time, with a tool that effectively mimics actual attacks or outages. In addition, the platform is accessible anywhere and from any device, allowing managers to easily asses new hires, monitor training progress, and even enable experience staff to log in and improve their cybersecurity skills.


Long-Term Strategy for the Skills Gap

While ISACA’s new testing tool helps identify ideal cybersecurity candidates, it can’t magically create new security experts to reduce the skills gap at large.

Addressing that challenge requires a two-pronged effort: Many post-secondary schools are now adopting security-focused IT tracks that give students critical training in real-world security management, and the development of advanced AI and automation tools are bolstering corporate ranks, allowing current security experts to embrace specificity in their roles. While it’s unlikely that cybersecurity cyborgs will ever take the place of human experts, why should companies waste time and effort on straightforward functions such as data collection, aggregation and reporting?

The cybersecurity skills gap isn’t going away — right now, companies and post-secondary institutions are playing catch up to fill vacant positions and address the increasing risk of network breaches. ISACA’s new tool is a critical stopgap: A way for HR teams to ensure that new security hires can both talk the talk and walk the walk when it comes to defending corporate IT interests.

More from

More School Closings Coast-to-Coast Due to Ransomware

Instead of snow days, students now get cyber days off. Cyberattacks are affecting school districts of all sizes from coast-to-coast. Some schools even completely shut down due to the attacks. The federal government recently warned that K-12 schools face a growing threat from cyber groups. According to the FBI, school districts often have limited cybersecurity protections, which makes them even more vulnerable. The FBI also says it anticipates the number of threats to increase. In a recent warning, the nation’s…

The Role of Human Resources in Cybersecurity

The human resources (HR) department is an integral part of an organization. They work with all departments with a wider reach than even IT. As a highly visible department, HR can support and improve an organization’s security posture through employee training. Their access to employees at the start of employment is an opportunity to lay a foundation for a culture of risk awareness. HR departments do not typically include cybersecurity risk awareness training with new hire onboarding, but it’s something…

New Attack Targets Online Customer Service Channels

An unknown attacker group is targeting customer service agents at gambling and gaming companies with a new malware effort. Known as IceBreaker, the code is capable of stealing passwords and cookies, exfiltrating files, taking screenshots and running custom VBS scripts. While these are fairly standard functions, what sets IceBreaker apart is its infection vector. Malicious actors are leveraging the helpful nature of customer service agents to deliver their payload and drive the infection process. Here’s a look at how IceBreaker…

Operational Technology: The evolving threats that might shift regulatory policy

Listen to this podcast on Apple Podcasts, Spotify or wherever you find your favorite audio content. Attacks on Operational Technology (OT) and Industrial Control Systems (ICS) grabbed the headlines more often in 2022 — a direct result of Russia’s invasion of Ukraine sparking a growing willingness on behalf of criminals to target the ICS of critical infrastructure. Conversations about what could happen if these kinds of systems were compromised were once relegated to “what ifs” and disaster movie scripts. But those days are…