Building the Cybersecurity Workforce of Tomorrow: Strategies for 2025 and Beyond
Blog
December 20, 2024
This third and final blog will address key takeaways from the CompTIA State of Cybersecurity 2025 Report about deploying a smart workforce strategy. Just as it is essential to consider multiple cybersecurity layers, it is also important to build multiple layers of cybersecurity expertise to align with an organization’s cybersecurity strategy.
As a CompTIA partner, SureShield is pleased to offer an abbreviated, three-part version of the full CompTIA Report. We encourage you to utilize the entire report in the upcoming months for strategic and data-driven insights to fortify your organization’s cybersecurity posture in 2025.
The Shift from Generalists to Specialists
The practice of relegating cybersecurity responsibilities to technology generalists is quickly fading. Professionals in every tech discipline must have some degree of cybersecurity acumen related to their field, and many highly specialized roles are being explored within dedicated cybersecurity teams.
Businesses continue to be biased toward using internal resources as the foundation of cybersecurity efforts. Over half of all firms in the survey state that they utilize in-house dedicated cybersecurity professionals or other in-house technology professionals as part of their staffing strategy. Compared to 2023, there was a slight increase in the number of firms with dedicated staff.
Third-party resources remain an important part of the resource equation for many firms, with approximately one-third of companies utilizing either specialized cybersecurity providers or partners that provide a variety of technological services. Larger firms are more likely than their smaller counterparts to use specialized providers or consultants, pointing to an opportunity for technology firms servicing small clients to add more cybersecurity focused offerings to their portfolio.
Building a Multi-Layered Cybersecurity Workforce
Internal vs. External Resources: Across both internal and external resources, organizations are building hierarchies of cybersecurity skills. As cybersecurity emerged as a standalone discipline, the first step for many businesses was to develop cybersecurity specialists from an established base of infrastructure professionals. Now that cybersecurity practices are more mature and growing in scope, forward-thinking companies are creating dedicated teams with depth and robust career pathways.
Hierarchy of Skills in Cybersecurity: The CompTIA member survey findings related to skill level and improvement opportunities suggest a lack of detailed cybersecurity skill awareness and provide the impetus for this team-building approach. Consistent with previous CompTIA research, organizations cite significant need for improvement even in areas where they also cite relative strength of skill. Network and infrastructure security is certainly not a new topic, but companies need a cadre of employees focused on the evolutions within this foundational area as they develop targeted skills related to identity management or penetration testing.
Training and Certification – Cybersecurity Skills Across the Workforce
A hierarchical approach to cybersecurity skills meets the demand for training and certification. Even early-career positions in cybersecurity require some knowledge of technology systems and cybersecurity methodology. Candidates for these positions may demonstrate their knowledge through various educational tracks and achievements; from that point, organizations need to continue providing skill-building options for career development and corporate health.
There is still strong intent to hire for cybersecurity, with 53% of companies considering new hiring as an option. However, intent to hire can be derailed by external forces and prove challenging in even the best cases as businesses fight over a limited pool of expertise. An even greater number of firms (56%) plan to pursue training for their cybersecurity workforce, and 42% plan to offer cybersecurity certifications as a way of establishing core concepts within the team and extending skills into emerging focus areas.
About Leadership-Executive Engagement Matters
Developing skills is the most significant action companies can take to improve efficiency, but there are also other critical strategies to consider. Increasing visibility, awareness, and communication with the organization’s leaders do matter, and it matters a lot. Engaging senior executives points all the way back to the beginning of the architectural approach.
Long-Term Strategy and Integration with Business Objectives
Establishing organizational imperatives and metrics gives cybersecurity teams a greater stake in future accomplishments. From there, building policies that drive employee behavior will create a culture of cybersecurity that helps the team do their job without additional tension.
Finally, companies need to focus on the long-term outlook for cybersecurity professionals. As with most technology roles, churn and burnout can make it difficult to realize a strategic vision. Along with skill building, the ease of procuring necessary tools and tight integration with business initiatives can provide the necessary support for engagement and career growth.
As digital efforts push new boundaries, it may be tempting to reduce cybersecurity initiatives back to a simplified view, where a baseline set of technology products provides a relatively reliable defense. This viewpoint would underestimate the complexity of technology integration and the criticality of digital operations. Instead, companies should embrace the challenges of structuring cybersecurity as a business imperative and building the skills necessary for corporate well-being and success.
As organizations navigate the complex cybersecurity landscape, a robust and multi-layered approach to workforce development is essential. By shifting from generalists to specialists, leveraging both internal and external resources, and prioritizing continuous training and certification, companies can build a resilient cybersecurity workforce. Engaging senior leadership and integrating cybersecurity with business objectives will further enhance organizational security posture. Ultimately, embracing these strategies will not only protect digital assets but also drive long-term success in an ever-evolving digital world.
About SureShield and ComptTIA
A proud CompTIA Partner, SureShield’s technology provides crucial support for the CompTIA Trustmark program, which aims to strengthen cybersecurity maturity and culture within the global Managed Service Provider (MSP) community.
SureShield’s SecurityShield and ComplyShield platforms provides AI-driven security and compliance technology and support features. ComplyShield delivers continuous management and automation by mapping to industry-accepted best practices and regulatory frameworks, including CIS, ISO/27001, NIST SP 800-171, HIPAA, CMMC, SOC2, FedRamp, and others.
The Computing Technology Industry Association (CompTIA) is the world’s leading information technology (IT) certification and training body. CompTIA is a mission-driven organization committed to unlocking the potential of every student, career changer, or professional seeking to begin or advance in a technology career. The CompTIA Trustmark is a process and certification that provides MSPs with the evidence they need to prove their cyber prowess.