August 10, 2022 By Jennifer Gregory 2 min read

A recent survey found that the majority of organizations struggle to retain cybersecurity workers. By focusing on improving retention, businesses can also reduce their digital risk.

Increased retention concerns

As new cybersecurity concerns increase, businesses also face an uphill battle to retain the talent needed to keep their data safe. A recent State of the Cybersecurity Workforce study reported that 43% of organizations saw an increase in attacks in the last year. It’s even more challenging to deal with this when they are constantly filling open positions. That means inexperienced workers or not enough people handling the infrastructure.

A key finding from the report was that 60% of respondents have issues retaining cybersecurity workers. That’s a 7% increase from last year. Plus, 63% of respondents have open positions. The survey included multiple industries, with 25% of respondents in the technology services/consulting industry, 21% in finance and 16% in the government.

The report also found a connection between increased attacks and retention issues. Of respondents who faced more attacks in the past year, 69% report being somewhat or very understaffed. This finding illustrates the critical nature of addressing retention issues as a key part of reducing risk and vulnerabilities. However, the study also found that lower retention rates make it harder to retain employees going forward. 73% of groups who are very understaffed reported challenges retaining workers.

Reasons for retention issues

The survey notes that the lower retention numbers are likely due, at least in part, to the current tensions between employees and leadership throughout all departments and industries. Many workers want to continue the flexibility of remote working, while some employers want their staff at the physical office building. Many companies have made changes to return-to-work mandates in hopes of reducing attrition, but there is not enough data yet to determine if these changes make an impact on cybersecurity retentions.

Other reasons cited by respondents for retention challenges include:

  • Recruited by other companies (59%)
  • Poor financial incentives (48%)
  • Limited promotion and development (47%)
  • High work stress levels (45%)
  • Lack of management support (34%).

Importance of retention will increase in the future

Because the demand for the cybersecurity profession is only going to increase, organizations that have low retention rates will struggle even more. 92% expect the demand for technical cybersecurity workers to increase in the future. Plus, 63% predict an increase in demand for executive-level workers in this field.

The key is to focus not only on reducing cybersecurity risk but on hiring and retaining top talent. By creating a positive work environment that includes competitive benefits, professional development and an upward career path, you can retain cybersecurity workers while improving cyber defenses.

More from News

Hackers are increasingly targeting auto dealers

3 min read - Update as of July 11, 2024 In late June, more than 15,000 car dealerships across North America were affected by a cyberattack on CDK Global, which provides software to car dealers. After two cyberattacks over two days, CDK shut down all systems, which caused delays for car buyers and disruptions for the dealerships. Many dealerships went back to manual processes, including handwriting up orders, so that sales could continue at a slower pace. Car buyers who recently bought a car from…

CISA director says banning ransomware payments is off the table

3 min read - The FBI, CISA and NSA all strongly advise against organizations making ransomware payments if they fall victim to ransomware attacks. If so, why not place a ban on paying ransomware demands? The topic came up at a recent Oxford Cyber Forum. Jen Easterly, Director of CISA, commented on the issue, saying, “I think within our system in the U.S. — just from a practical perspective — I don’t see it happening.” It’s unlikely this was a purely spontaneous remark as the…

A proactive cybersecurity policy is not just smart — it’s essential

3 min read - It’s easy to focus on the “after” when it comes to cybersecurity: How to stop an attack after it begins and how to recover when it's over. But while a reactive response sort of worked in the past, it simply is not good enough in today’s world. Not only are attacks more intense and more damaging than ever before, but cyber criminals also use so many different attack methods. Zscaler ThreatLabz 2024 Phishing Report found that phishing attacks increased by…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today