# An Investigation into the Cybersecurity Skills Gap in South Africa

Michael De Jager, Lynn Futcher, Kerry-Lynn Thomson

► To cite this version:

Michael De Jager, Lynn Futcher, Kerry-Lynn Thomson. An Investigation into the Cybersecurity Skills Gap in South Africa. 17th International Symposium on Human Aspects of Information Security and Assurance (HAISA), Jul 2023, Kent, United Kingdom. pp.237-248, 10.1007/978-3-031-38530-8_19 hal-05462104

HAL Id: hal-05462104

https://inria.hal.science/hal-05462104v1

Submitted on 16 Jan 2026

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons CC BY 4.0 - Attribution - International License
<figure><img src="image_2.png" /></figure>

ifip

International Federation for Information Processing

This document is the original author manuscript of a paper submitted to an IFIP
conference proceedings or other IFIP publication by Springer Nature. As such, there
may be some differences in the official published version of the paper. Such
differences, if any, are usually due to reformatting during preparation for publication or
minor corrections made by the author(s) during final proofreading of the publication
manuscript.
<figure><img src="image_3.png" /></figure>

# An Investigation into the Cybersecurity Skills Gap in South Africa

Michael de Jager✉, Lynn Futcher✉, and Kerry-Lynn Thomson✉

Nelson Mandela University, Port Elizabeth, South Africa
{michael.dejager,lynn.futcher,kerry-lynn.thomson}@mandela.ac.za

**Abstract.** South Africa is currently one of the largest targets for hackers and cyber terrorists in the world. With the increase in such cyber threats, there is a growing need and demand for IT professionals with the requisite cybersecurity skills and knowledge to combat and mitigate these threats. However, an ever-increasing cybersecurity skills gap has been identified both globally and in South Africa. This study investigated the cybersecurity skills demand, needs, and challenges of IT professionals in South Africa by reporting on IT professionals' perceptions in this regard. An online questionnaire, distributed to IT professionals using various online platforms, was used to gather this information. According to the findings of the study, there are several challenges, such as lack of time, lack of funding and lack of resources, that South Africa must overcome in order to address the cybersecurity skills gap. It was also found that the perception is that higher education institutions (HEIs), organisations and the South African government are not investing enough into cybersecurity skills development. Without the right cybersecurity skills set and investment in the development of cybersecurity skills, cyber threats will continue to increase and will potentially become more harmful to South African organisations and to the South African society at large.

**Keywords:** Cybersecurity · cybersecurity skills gap · IT professionals · South Africa

## 1 Introduction

Cybersecurity has become an increasingly important issue in today's digital world, with organisations and individuals facing a growing number of cyber threats. However, in South Africa, like many other countries, there is a significant cybersecurity skills gap that is hindering the country's ability to effectively mitigate these threats. The shortage of skilled cybersecurity professionals has been attributed to various factors, including the lack of formal cybersecurity education and training programs, lack of cybersecurity awareness, and inadequate investment into cybersecurity skills development by both the government and organisations [1]. This skills gap presents a significant challenge for South Africa, as it leaves the country vulnerable to cyberattacks and puts sensitive data and critical infrastructure at risk. Addressing this gap would require a concerted effort from all stakeholders, including the government, academia, and organisations, to prioritise and invest in cybersecurity education, training, and awareness.
According to the global Cyber Exposure Index, South Africa is the sixth most frequently targeted nation for cyberattacks [2]. In South Africa, malware attacks increased by 22% in the first quarter of 2019, compared to the same time frame in 2018. This translates to just over nine cyberattacks each second, or 13842 attempts per day [3]. Cybersecurity skills must advance in response to this rise in cyberattacks in South Africa if it is to be effective at mitigating such attacks.

Research has found that there is an ever-increasing gap in the cybersecurity skills of IT professionals, both globally and in South Africa [1, 4–6]. Combined with the cybersecurity skills shortage, the rise in cybercrime has led to an increased demand for IT professionals that are highly skilled in cybersecurity. Despite various cybersecurity-related certifications and cybersecurity curricula guidelines having been drafted to promote such education and training of IT professionals, the cybersecurity skills gap remains a problem globally [1, 7].

A global report showed that minimal progress has been made in cybersecurity skills development in organisations since 2017 [8]. According to the report, 70% of IT professionals believe that the cybersecurity skills shortage is having a negative impact on their organisation, and 45% believe that the shortfall and its consequences are becoming worse.

The aim of this paper was to investigate the cybersecurity skills demand, needs and challenges of IT professionals in South Africa. This was done by conducting a survey through a questionnaire distributed to IT professionals within South Africa.

This paper is structured as follows. Section 2 provides related literature regarding the cybersecurity skills gap both globally and in South Africa. Section 3 discusses the research methodology used in this study, with a key focus on the questionnaire used in the survey. This is followed by Sect. 4 which presents the results and findings from the questionnaire and Sect. 5 which concludes the paper.

## 2 Background

In order to better understand the present cybersecurity skills gap, Oltsik undertook a global poll in 2020 [8]. 77% of the survey respondents had previously worked in an Information Technology (IT) job role unrelated to cybersecurity. Given that these IT professionals are responsible for cybersecurity, this lead to an opportunity to better identify their cybersecurity knowledge, skills and abilities (KSAs) for their specific job roles. Results of the poll indicated that there are a number of factors that contribute to the cybersecurity skills gap globally. Firstly, the study found that the majority of IT professionals were dissatisfied with their existing jobs. This could result in high dropout rates in the foreseeable future, widening the already significant cybersecurity skills gap. Secondly, Oltsik [8] discovered that over 70% of IT professionals are under significant work stress, which could further contribute to high turnover rates. Furthermore, 62% of respondents stated that their organisation does not provide appropriate cybersecurity training to bring employees up-to-date on the current cyber threats, nor do they provide training in the required cybersecurity skills to combat such cyber threats.

The ISACA State of Cybersecurity Survey provides a distinctive view of cybersecurity from the viewpoint of IT professionals who define and practise in the field of
cybersecurity [9]. The ISACA survey examined potential contributing factors to the lack of skilled IT professionals in cybersecurity, and their lack of relevant cybersecurity skills and knowledge. The survey indicated that technically trained cybersecurity experts are in short supply. Furthermore, it showed that it is extremely difficult to employ cybersecurity professionals and that employer-paid training and certifications do not guarantee recruitment. The study results indicated that it takes at least six months before an open cybersecurity position can be filled, and that there is a year on-year 8% increase in cybersecurity job vacancies in organisations. The struggle to fill open positions in cybersecurity, especially technical roles, remains high. One of the causes of these unfilled cybersecurity roles is the shortage of trained IT professionals applying for open positions [6].

In order for cybersecurity to be properly practiced and implemented, Information Technology (IT) professionals need to have the right skills and expertise to perform effective cybersecurity [1]. However, it is not as easy to define the skills and abilities that are needed in a cybersecurity workforce as it is to define a set of technical skills in which IT professionals can be trained. Various job roles, how to adapt team management to meet current and future cybersecurity requirements, and how each cybersecurity professional fits within an organisation must be considered [10].

According to an Accenture report, South Africa is a target for cybercrime owing to its low investment in cybersecurity and immature cybercrime legislation and has been indicated as one of the most targeted countries in the world [11, 12]. Furthermore, as in other nations, a lack of cybersecurity skills is limiting the capacity of organisations to effectively manage and remain ahead of rapidly emerging cyber threats. Without the necessary cybersecurity skills, organisations are at a disadvantage and are vulnerable to cyberattacks [13].

South Africa, like the rest of the world, is grappling with the cybersecurity skills gap. The lack of IT professionals with a thorough understanding of cybersecurity has created a problem for many South African organisations. According to an ICT Skills Survey, conducted by the Institute of IT Professionals of South Africa (IITPSA), South Africa's top ICT priority should be information security and cybersecurity [14]. It was also recorded that the need for skills in cybersecurity increased dramatically between 2021 and 2022 and is ever-growing, suggesting an increasing need for IT professionals in cybersecurity in South Africa. In addition, a 2018 study found that cybersecurity professionals were needed in over 20 South African industries [1].

In support of this, two recent studies [15, 16] conducted content analyses of South African job postings to determine the current demand for cybersecurity skills in South Africa. The results of both studies can be used by higher education institutions to better align their IT-related qualifications to the needs of industry.

## 3 Research Methodology

A survey, in the form of a questionnaire, was designed to conduct this study. The questionnaire was created in QuestionPro and distributed to IT professionals in South Africa using various online platforms such as IT professional online newsletters, social media platforms (including LinkedIn, Twitter, Facebook and Instagram) and special interest
groups. It was also distributed to various South African IT professional LinkedIn groups. This study was conducted from February to May 2022. The main aim of the questionnaire was to investigate the cybersecurity skills demand and needs of IT professionals in South Africa. The perceptions of IT professionals in this regard were collected, together with the challenges faced in addressing the cybersecurity skills gap in South Africa. In addition, it helped determine the extent to which cybersecurity-related skills are required and currently used by IT professionals in South Africa.

A number of existing cybersecurity skills surveys were identified and analysed to determine relevant questions for this study. The two surveys found to be the most relevant were the Cybrary 2020 Research Survey Report [17] and the McAfee Hacking the Skills Shortage [18] study. A number of questions were taken from these cybersecurity skills reports and adapted accordingly.

The questionnaire was structured so that each section addressed a different focus area of the study. These sections included:

* Section A - Demographics;

* Section B - General Cybersecurity Perceptions;

* Section C - Cybersecurity Skills Development; and

* Section D - Cybersecurity-related Skills.

Purposive sampling was used in this study since the participant sample was recruited from IT professionals in South Africa who engage on various online platforms, including online newsletters and social media platforms. These participants volunteered to be part of the study by providing their consent before answering the questionnaire. Ethics approval was obtained through the university Research Ethics Committee to conduct this study.

The nonparametric Wilcoxon Signed Rank Test was used to compare the median of the participants' perceptions of the impact and differences in South Africa and their organisation, and to determine whether there was a significant difference in the responses regarding South Africa and the participants' organisations. Results therefore included what was formulated from the participants' responses and any shared concerns highlighted in the literature review conducted as part of this study.

# 4 Results and Findings

Although 628 IT professionals accessed and viewed the online questionnaire, only 77 participants fully completed the survey. Questionnaires that were partially completed were not considered as part of this study. Therefore, only responses from the 77 participants were analysed to determine the results and findings for this study.

## 4.1 Section A - Demographics

The purpose of Section A was to gather the demographic data relating to each participant. It must be noted that no personally identifiable information (PII) was collected from any of the participants of the 77 participants, 70.1% indicated that they were male, with the remaining 29.9% being female. The 35 to 44 years age group had the highest number
of participants (31.2%), followed by 24.7% of participants in each of the 25 to 34 years and 45 to 54 years age groups.

In terms of participants' education, the majority of participants (59.7%) indicated that they have a postgraduate diploma or degree, with Information Technology (45.5%) and Information Systems (14.3%) being their main fields of study.

Furthermore, 45.5% of participants indicated that they are employed by the oil and gas sector, with most specifying their current position within their organisation to be managerial (42.9%), followed by technical (36.4%). In addition, the majority of participants (51.9%), claimed to have fewer than five years of experience in their current position. In comparison, 19.5% of participants claimed to have more than 25 years of IT experience, with a further 19.5% stating that they have between 6 and 10 years of IT experience.

## 4.2 Section B – General Cybersecurity Perceptions

The purpose of Section B was to determine the perceptions of IT professionals relating to the general cybersecurity skills demand and needs in South Africa, and the importance of cybersecurity within their organisation and South Africa.

A combined majority of the participants indicated that cybersecurity was important to their organisation (93.5%), with ratings from Slightly Important to Extremely Important, with 22.1% indicating their organisation to be highly vulnerable to cyber threats.

The participants were also asked to rate, on a 5-point Likert scale, how strongly they agreed or disagreed with various statements relating to cybersecurity. These results are illustrated in Fig 1.

<figure><img src="image_4.png" /><figcaption>Fig. 1. General Cybersecurity Perceptions (Organisations and South Africa)</figcaption></figure>

Although 68.9% of participants indicated that their organisation had not suffered from reputational damage through cyberattacks and more than 63.7% of the participants indicated that their organisation had not lost any proprietary data through cyberattacks, 53.3% of participants perceived their organisation to be a target for hackers (or cyber threats). From Fig 1 it is evident that more than 88.3% of the participants agreed (or
strongly agreed) that a cybersecurity skills shortage exists in South Africa, while only 55.9% agreed (or strongly agreed) that a cybersecurity skills shortage exists within their own organisation.

<figure><img src="image_5.png" /><figcaption>**Fig. 2.** General Cybersecurity Perceptions (Investment in Cybersecurity Skills)</figcaption></figure>

Furthermore, as reflected in Fig 2, although only 17.2% of the participants perc eive higher education institutions facilities, such as universities and colleges, to be investing enough in cybersecurity-related skills, 57.2% of the participants agreed (or strongly agreed) that their organisation is investing enough in cybersecurity skills, with only 3.9% of the participants agreeing (or strongly agreeing) that the South African government is investing enough in cybersecurity skills.

**4.3 Section C – Cybersecurity Skills Development**

The aim of Section C was to establish the participants’ perceptions regarding cyber-
security skills development within their organisation and South Africa, and the main
challenges faced in addressing the cybersecurity skills gap.

As shown in Fig. 3, a lack of time (59.8%), lack of motivation (57.2%), lack of funding (54.6%), and an unsupportive/work environment (53.3%) were all considered to have a high to moderate impact on the cybersecurity skills development in the participants’ organisations.

However, within the South African context as shown in Fig. 4, the participants perceived both a lack of resources (89.6%) and a lack of funding (89.6%) to have the highest impact, followed by an unsupportive/work environment (84.5%), lack of motivation (88.3%), lack of time (62,4) and social/cultural barriers (61.1%).

To test whether there is a significant difference in the participants’ perceptions of South Africa and their organisations, the Wilcoxon Signed Rank Test was used. These results are indicated in Table 1.

As indicated in Table 1, there is a statistically significant difference between South Africa and the participants’ organisations for most of the challenges listed where p<0.001 (i.e. Lack of Funding, Lack of Motivation, Lack of Resources, Language Barrier, Learning Disability, Social/Cultural Barriers and Unsupportive Managers/Work Environment). Furthermore, the participants perceived each of these challenges to have a greater impact within South Africa compared to within their own organisations. However, there was no significant difference with regard to the Lack of Time challenge in
<figure><img src="image_6.png" /><figcaption>Fig. 3. Impact of Challenges on Cybersecurity Skills Development (Organisation)</figcaption></figure>

<figure><img src="image_7.png" /><figcaption>Fig. 4. Impact of Challenges on Cybersecurity Skills Development (South Africa)</figcaption></figure>

South Africa and the participants’ organisations (Z = -0.926, p = 0.354). It was found that the participants perceived the Lack of Time challenge to have the same level of impact within South Africa and within their own organisations.

In addition, seven participants indicated additional challenges, not listed in the questionnaire, that they perceive as having an impact on the development of cybersecurity skills in their organisation. These included the following responses:

* “The changing threat landscape”;

* “Organisational culture”;

* “Lack of defined career path and lack of communication of the opportunities”;

* “Retention of qualified staff in a buoyant market for these skills”;

* “Lack of awareness of cybersecurity”;

* “User incompetence and indifference”;
<table><caption>**Table 1.** Wilcoxon Signed Rank Test results for the impact of various challenges on cybersecurity skills development in South Africa and within the participants' organisations</caption><thead><tr><th>Tests</th><th>Group</th><th>N</th><th>Mean Rank</th><th>Rank Sum</th><th>Z</th><th>p</th></tr></thead><tbody><tr><td rowspan="3">Lack of Funding</td><td>Negative rank</td><td>5</td><td>15</td><td>75</td><td rowspan="3">-5.577*</td><td rowspan="3">&lt;0.001*</td></tr><tr><td>Positive rank</td><td>45</td><td>26.67</td><td>1200</td></tr><tr><td>Ties</td><td>27</td><td></td><td></td></tr><tr><td rowspan="3">Lack of Motivation</td><td>Negative rank</td><td>9</td><td>19.22</td><td>173</td><td rowspan="3">-5.053*</td><td rowspan="3">&lt;0.001*</td></tr><tr><td>Positive rank</td><td>45</td><td>29.16</td><td>1312</td></tr><tr><td>Ties</td><td>23</td><td></td><td></td></tr><tr><td rowspan="3">Lack of Resources</td><td>Negative rank</td><td>6</td><td>15</td><td>90</td><td rowspan="3">-3.624*</td><td rowspan="3">&lt;0.001*</td></tr><tr><td>Positive rank</td><td>28</td><td>18.04</td><td>505</td></tr><tr><td>Ties</td><td>43</td><td></td><td></td></tr><tr><td rowspan="3">Lack of Time</td><td>Negative rank</td><td>19</td><td>22.08</td><td>419.5</td><td rowspan="3">-.926*</td><td rowspan="3">0,354*</td></tr><tr><td>Positive rank</td><td>25</td><td>22.82</td><td>570.5</td></tr><tr><td>Ties</td><td>33</td><td></td><td></td></tr><tr><td rowspan="3">Language Barrier</td><td>Negative rank</td><td>4</td><td>20.5</td><td>82</td><td rowspan="3">-5.933*</td><td rowspan="3">&lt;0.001*</td></tr><tr><td>Positive rank</td><td>49</td><td>27.53</td><td>1349</td></tr><tr><td>Ties</td><td>24</td><td></td><td></td></tr><tr><td rowspan="3">Learning Disability</td><td>Negative rank</td><td>7</td><td>20.71</td><td>145</td><td rowspan="3">-4.356*</td><td rowspan="3">&lt;0.001*</td></tr><tr><td>Positive rank</td><td>38</td><td>23.42</td><td>890</td></tr><tr><td>Ties</td><td>32</td><td></td><td></td></tr><tr><td rowspan="3">Social/Cultural Barriers</td><td>Negative rank</td><td>8</td><td>23.13</td><td>185</td><td rowspan="3">-4.566*</td><td rowspan="3">&lt;0.001*</td></tr><tr><td>Positive rank</td><td>41</td><td>25.37</td><td>1040</td></tr><tr><td>Ties</td><td>28</td><td></td><td></td></tr><tr><td rowspan="3">Unsupportive Managers/Work Environment</td><td>Negative rank</td><td>6</td><td>16.75</td><td>100.5</td><td rowspan="3">-4.932*</td><td rowspan="3">&lt;0.001*</td></tr><tr><td>Positive rank</td><td>40</td><td>24.51</td><td>980.5</td></tr><tr><td>Ties</td><td>31</td><td></td><td></td></tr></tbody></table>

* “Excessive workload with cybersecurity being a low priority”.

These additional challenges further highlight the concerns regarding cybersecurity skills development in some organisations.

Furthermore, twelve participants indicated additional challenges, not listed in the questionnaire, that they perceive as having an impact on the development of cybersecurity skills in South Africa. These included the following responses:

* “Lack of awareness amongst law enforcement and authorities”;

* “Lack of qualified, motivated individuals capable of doing the required work”;

* “The ever-changing threat landscape”;

* “Lack of data and infrastructure”;

* “Ineffective policy implementation”;

* “Lack of communication and advertisement of the career opportunities”;

* “Lack of good quality training programmes/facilities/institutions”;

* “Government lagging behind in regulating and developing strategies”;

* “Lack of awareness of cyber threats”;

* “Lack of awareness campaigns on cybersecurity at schools, government depart- ments and communities”;

<footnote>*Based on negative ranks basis (p< 0.05).</footnote>
* “Lack of employees with qualifications that specialise in information security”;

* “Security requirements are often afterthoughts rather than first-class features”.

These additional challenges further highlight the concerns regarding cybersecurity skills development within South Africa.

## 4.4 Section D – Cybersecurity-Related Skills

The aim of Section D was to determine the perceptions of IT professionals relating to the cybersecurity skills demand and needs in their organisation and in South Africa, and to determine the extent to which cybersecurity-related skills are required and currently used by IT professionals in their day-to-day jobs.

Table 2 shows the cybersecurity-related skills, identified as lacking, according to cybersecurity skills category and rank. When asked which skills the participants lack, but would be beneficial to their organisation, the following skills came out as the top five skills: Audit and Compliance (Rank = 1), Security Governance (Rank = 2), Threat Analysis and Defence (Rank = 3), Threat Intelligence and Detection (Rank = 4) and Attack Mitigation (Rank = 5).

<table><caption>**Table 2.** Cybersecurity-related skills currently lacking according to category and rank</caption><thead><tr><th>Skills Category</th><th>Cybersecurity-related Skills</th><th>Ranking (1 to 25)</th></tr></thead><tbody><tr><td rowspan="6">IT Management and Governance Skills</td><td>Incident Management</td><td>25</td></tr><tr><td>Disaster Recovery and Management</td><td>18</td></tr><tr><td>Risk Management</td><td>9</td></tr><tr><td>IT Governance</td><td>8</td></tr><tr><td>Security Governance</td><td>2</td></tr><tr><td>Audit and Compliance</td><td>1</td></tr><tr><td rowspan="8">Network and Application Security Skills</td><td>Infrastructure Support and Design</td><td>22</td></tr><tr><td>Security Administration</td><td>20</td></tr><tr><td>Secure Application Development</td><td>16</td></tr><tr><td>Intrusion Detection</td><td>15</td></tr><tr><td>Network Security</td><td>12</td></tr><tr><td>Attack Mitigation</td><td>5</td></tr><tr><td>Threat Analysis and Defence</td><td>3</td></tr><tr><td rowspan="4">Administrative Skills</td><td>Network Administration and Support</td><td>24</td></tr><tr><td>Database Administration</td><td>23</td></tr><tr><td>Firewall Administration</td><td>19</td></tr><tr><td>Security Programme Management</td><td>17</td></tr><tr><td rowspan="7">Security Testing and Troubleshooting Skills</td><td>Troubleshooting</td><td>21</td></tr><tr><td>Failure Analysis</td><td>14</td></tr><tr><td>Vulnerability Testing</td><td>13</td></tr><tr><td>Cyber Resilience</td><td>11</td></tr><tr><td>Security Assessment and Testing</td><td>10</td></tr><tr><td>Cyber Forensics</td><td>7</td></tr><tr><td>Threat Intelligence and Detection</td><td>4</td></tr></tbody></table>

The responses from two further questions in Section D were used to determine whether there is a significant difference between the importance of cybersecurity-related skills in South Africa and in the participants’ organisations. The results from the Wilcoxon Signed Rank Test are presented in Table 3.
<table><caption>**Table 3.** Wilcoxon Signed Rank Test results for the importance of cybersecurity related skills in South Africa and in the participants' organisations</caption><thead><tr><th>Tests</th><th>Group</th><th>N</th><th>Mean Rank</th><th>Rank Sum</th><th>Z</th><th>p</th></tr></thead><tbody><tr><td rowspan="3">Administrative Skills</td><td>Negative rank</td><td>12</td><td>13</td><td>156</td><td rowspan="3">-0.180*</td><td rowspan="3">0.857*</td></tr><tr><td>Positive rank</td><td>12</td><td>12</td><td>144</td></tr><tr><td>Ties</td><td>53</td><td></td><td></td></tr><tr><td rowspan="3">IT Management and Governance Skills</td><td>Negative rank</td><td>9</td><td>12.39</td><td>111.5</td><td rowspan="3">-0.250*</td><td rowspan="3">0.803*</td></tr><tr><td>Positive rank</td><td>11</td><td>8.95</td><td>98.5</td></tr><tr><td>Ties</td><td>57</td><td></td><td></td></tr><tr><td rowspan="3">Network and Application Security Skills</td><td>Negative rank</td><td>12</td><td>9.76</td><td>117.5</td><td rowspan="3">-0.951*</td><td rowspan="3">0.342*</td></tr><tr><td>Positive rank</td><td>7</td><td>10.36</td><td>72.5</td></tr><tr><td>Ties</td><td>58</td><td></td><td></td></tr><tr><td rowspan="3">Security Testing and Troubleshooting Skills</td><td>Negative rank</td><td>10</td><td>11.6</td><td>116</td><td rowspan="3">-0.018*</td><td rowspan="3">0.986*</td></tr><tr><td>Positive rank</td><td>11</td><td>10.45</td><td>115</td></tr><tr><td>Ties</td><td>56</td><td></td><td></td></tr></tbody></table>

As shown in Table 3, according to their ‘p’ values (p>0.05), no significant difference was found between South Africa and the participants’ organisations for the importance of any of the four categories of cybersecurity-related skills provided. For both South Africa and the participants’ organisations, Network and Application Security Skills was considered as the most important category of cybersecurity-related skills, followed by IT Management and Governance Skills. Very few participants viewed these skills as not important.

The responses from a further two questions in Section D were used to determine whether there is a significant difference between the scarcity of cybersecurity-related skills in South Africa and in the participants’ organisations. The results from the Wilcoxon Signed Rank Test are presented in Table 4.

<table><caption>**Table 4.** Wilcoxon Signed Rank Test results for the scarcity of cybersecurity related skills in South Africa and in the participants’ organisation</caption><thead><tr><th>Tests</th><th>Group</th><th>N</th><th>Mean Rank</th><th>Rank Sum</th><th>Z</th><th>p</th></tr></thead><tbody><tr><td rowspan="3">Administrative Skills</td><td>Negative rank</td><td>8</td><td>20</td><td>160</td><td rowspan="3">-5.351*</td><td rowspan="3">&lt;0.001*</td></tr><tr><td>Positive rank</td><td>47</td><td>29.36</td><td>2220</td></tr><tr><td>Ties</td><td>22</td><td></td><td></td></tr><tr><td rowspan="3">IT Management and Governance Skills</td><td>Negative rank</td><td>10</td><td>22.45</td><td>224.5</td><td rowspan="3">-4.115*</td><td rowspan="3">&lt;0.001*</td></tr><tr><td>Positive rank</td><td>40</td><td>26.26</td><td>1050.5</td></tr><tr><td>Ties</td><td>27</td><td></td><td></td></tr><tr><td rowspan="3">Network and Application Security Skills</td><td>Negative rank</td><td>6</td><td>20.5</td><td>123</td><td rowspan="3">-4.379*</td><td rowspan="3">&lt;0.001*</td></tr><tr><td>Positive rank</td><td>37</td><td>22.24</td><td>823</td></tr><tr><td>Ties</td><td>34</td><td></td><td></td></tr><tr><td rowspan="3">Security Testing and Troubleshooting Skills</td><td>Negative rank</td><td>6</td><td>13.92</td><td>83.5</td><td rowspan="3">-4.037*</td><td rowspan="3">&lt;0.001*</td></tr><tr><td>Positive rank</td><td>30</td><td>19.42</td><td>582.5</td></tr><tr><td>Ties</td><td>41</td><td></td><td></td></tr></tbody></table>

<footnote>*Based on negative ranks basis (p< 0.05).</footnote>

<footnote>*Based on negative ranks basis (p< 0.05).</footnote>
As shown in Table 4, there is a statistically significant difference between the scarcity of all four of the cybersecurity skills categories between South Africa and the participants’ organisations (p<0.001). The participants perceived all four of the cybersecurity skills categories to have a greater scarcity within the South African domain compared to their own organisations.

## 5 Conclusion

With the ongoing increase in cyber threats, the demand and need for IT professionals trained in relevant cybersecurity-related skills is also growing.

Despite only 77 participants, this paper presents some understanding of the perceived cybersecurity skills demands and needs of IT professionals in South Africa.

By recognising the criticality of cybersecurity skills and addressing the evolving needs and demands of IT professionals in South Africa, significant steps could be taken towards bridging the cybersecurity skills gap. It is imperative for higher education institutions and the government in South Africa to fully understand the pressing need for cybersecurity skills and the ever-growing demands of the IT industry. By recognising the degree of the cybersecurity skills gap and implementing strategic changes in education and policy, the way could be paved for a secure and resilient digital landscape. This includes offering relevant and up-to-date cybersecurity curricula in higher education institutions, promoting industry-academia collaborations, providing incentives for cybersecurity professionals, and fostering a culture of cybersecurity awareness and best practices.

Unfortunately, South Africa currently has very few policies and frameworks that address cybersecurity skills development. The National Cybersecurity Policy Framework (NCPF), which addresses cybersecurity at a national level, contains limited detail regarding cybersecurity skills development. The South African government could use this study to address specifics of cybersecurity skills development within the revised NCPF, or any additional cybersecurity laws, legislations and policies being developed.

Furthermore, this study could assist higher education institutions offering IT-related qualifications in identifying various cybersecurity skills that could be integrated into the respective qualifications. In addition, it could assist organisations in addressing the perceived challenges in the development of cybersecurity-related skills and assist organisations and the South African government in prioritising cybersecurity and the development of the necessary cybersecurity skills needed to mitigate the ever-increasing number of cyberattacks.

It is only through collective efforts that the cybersecurity skills gap can begin to be bridged to safeguard critical digital assets, and ensure a secure cyber future for South Africa.

## References

1. Parker, A., Brown, I.: Skills requirements for cyber security professionals: a content analysis of job descriptions in South Africa. In: Venter, H., Loock, M., Coetzee, M., Eloff, M., Eloff, J. (eds.) ISSA 2018. CCIS, vol. 973, pp. 176–192. Springer, Cham (2019). https://doi.org/10.1007/978-3-030-11407-7_13
2. CEI. Country statistics – Cyber Exposure Index (2020). https://cyberexposureindex.com/country-statistics/

3. Smith, C.: Major spike in SA cyber-attacks, over 10 000 attempts a day. News24 (2019). https://www.fin24.com/Companies/ICT/major-spike-in-sa-cyber-attacks-over-10-000-attempts-a-day-security-company-20190429

4. Crumpler, W., Lewis, J.A.: The cybersecurity workforce gap. Center for Strategic and International Studies, JANUARY, 1–10 (2019). http://www.isaca.org/Knowledge-Center/

5. Vavra, B.: Plugging the skills gap. Plant Eng. (Barrington, Illinois) **65**(7), 24–42 (2011)

6. Vogel, R.: Closing the cybersecurity skills gap. Salus J. **4**(2), 32–46 (2016)

7. Baker, M. Striving for effective cyber workforce development (2016)

8. Oltsik, J.: ESG Research Report: The Life and Times of Cybersecurity Professionals (2020). https://www.esg-global.com/research/esg-research-report-the-life-and-times-of-cybersecurity-professionals-2020/

9. ISACA. ISACAs state of cybersecurity 2022. Global update on workforce efforts, resources and cyberoperations (2022). https://www.isaca.org/go/state-of-cybersecurity-2022

10. Dawson, J., Thomson, R.: The future cybersecurity workforce: Going beyond technical skills for successful cyber performance. Front. Psychol. **9**, 1–12 (2018). https://doi.org/10.3389/fpsyg.2018.00744

11. Accenture. Insight into the cyberthreat landscape in South Africa. Accenture, **1**(1), 4–9 (2020) https://www.accenture.com/_acnmedia/PDF-125/Accenture-Insight-Into-The-Thr eat-Landscape-Of-South-Africa-V5.pdf

12. Surfshark. Data Breach Impact Statistics (2022). https://surfshark.com/research/data-breach- impact/statistics

13. Monzon, L.: The importance of training in managing a cybersecurity skills shortage - IT News Africa (2022). https://www.itnewsafrica.com/2022/04/the-importance-of-training-in-managing-a-cybersecurity-skills-shortage/

14. Schofield, A., Dwolatzky, B.: 2022 JCSE-IITPSA ICT Skills Survey The Twelfth Edition. 12th (2022)

15. Kruger, M., Futcher, L., Thomson, K.-L.: A thematic content analysis of the cybersecurity skills demand in South Africa. In: Clarke, N., Furnell, S. (eds.) Human Aspects of Information Security and Assurance. HAISA 2022. IFIP Advances in Information and Communication Technology, vol. 658, pp. 24–38. Springer, Cham (2022). https://doi.org/10.1007/978-3-031-12172-2_3

16. Brink, R., Ophoff, J., Ruhwanya, Z.: Relevant cybersecurity: curriculum guidance for the South African context. In: Barnett, R.J., le Roux, D.B., Parry, D.A., Watson, B.W. (eds.) ICT Education. SACLA 2022. Communications in Computer and Information Science, vol. 1664, pp. 3–19. Springer, Cham (2022). https://doi.org/10.1007/978-3-031-21076-1_1

17. Cybrary. Cybersecurity skills gap threatens job effectiveness amidst global talent shortage.2020ResearchSurveyReport (2020). https://downloads.ctfassets.net/kvf8rpi09wgk/5P1SsuT2i8LyB3or8yDoxU/d0e6b046f64418895509771e7f626769/Cybrary-Skills_Gap_Report.pdf

18. McAfee. Hacking the Skills Shortage. A study of the international shortage in cybersecurity skills (2017). https://www.mcafee.com/content/dam/enterprise/en-us/assets/reports/rp-hacking-skills-shortage.pdf