RESEARCH

Cybersecurity
Skills Gap Report 2020
February 2020

FOUNDATIONAL CONTROLS FORSECURITY, COMPLIANCE & IT OPERATIONSThe skills gap remains one ofthe biggest challenges within

Participant Demographics
Job LevelCompany Size

the cybersecurity industry. To
gain more perspective on whatorganizations are experiencing,
Tripwire partnered with
Dimensional Research to survey
342 security professionals on this

28%
36%

23%

30%

issue. This study explores hiring
trends, how security teams arechanging, and how they plan to47%

36%

address the issue in the face ofgrowing cyber threats.

100–1,000 employees

Executive

1,000–5,000 employees

Team manager

More than 5,000 employees

Individual contributor

Security teams continue to be understaffed
How would you characterize the sizeof your current security team?
2%
15%

16%

66%

Grossly understaffed
Slightly understaffed
The right size
Overstaffed2

83% say their security teams are feeling more overworked
Does your security team feel more
overworked going into 2020
compared to last year?

16%

1%
1%

Yes, significantly more
27%

Yes, slightly more
No, same as always
No, they are more relaxed
The team has never felt overworked

56%

Larger organizations, which you might assume have more resources, are experiencing the skills gap
issue even more acutely than smaller organizations
Does your security team feel more overworked going into 2020 compared to last year? (By company size)
100–1,000 Employees

1,000–5,000 Employees

More than 5,000 Employees

2%
1%

1%
1%

2%

18%

16%

17%

12%
24%
37%

63%

57%

Yes, significantly more
Yes, slightly more
No, same as always
No, they are more relaxed
The team has never felt overworked349%

85% say it’s harder to hire IT security staff now than a few years ago
In your experience, is it harder to hire IT security staff with neededskills and expertise now than it was a few years ago?

12%

Much harder4%

A bit harder26%

No change
A bit easier

59%

IT teams continue to report a wide range of problems in finding expertise
How is your organization experiencing or expecting to experienceproblems finding IT security staff with needed skills and expertise?
67%

Not enough qualified applicants
Available recruits need extensive training

55%

Difficulty retaining the talent we have

52%
28%

Hard to hire personnel for administrative jobs
010203040

45060

7080

The skills required to be a great security
professional are continuing to change
Have the skills required to be a great security
professional changed in the past few years?
August 2017

December 2019
Yes

6%

No

19%

82%

94%

The importance of expertise with hybrid
infrastructure continues to increase
How do you expect the importance of security expertise with hybrid(cloud/on-prem) infrastructure to change in the next two years?

6%

Increase dramatically1%

Increase somewhat
40%
54%

No change
Decrease

5CISOs have widely differing levels of involvement in day-to-day operations
Of the 85% that have a CISO, howinvolved is yours in day-to-day
technical security operations?
13%

How would you rate your CISO’slevel of involvement in day-to-day
security responsibilities?
10%

20%

14%
50%
40%
53%

Deeply involved

Too involved

Somewhat involved

Not involved enoughNot involved

Just the right amount

Only involved when there
is a serious issue

93% of IT security professionals are interested in understanding wellness issues
In recent years, there has been moreof a focus at conferences and in
online communities among security
professionals on managing workstress and mental health. Is this a
topic that is interesting to you?

Very interested
7%

Somewhat interested
44%

49%

6Not interested

Does your company provide accessto any resources for managing thestress associated with the specificissues of IT security (benefits,classes, coaches, etc.)?

Yes
No

19%

22%

There are work and stress resources,
but not specific to IT security

59%

9 out of 10 security teams (91%) expect to invest in IT security expertise in 2020
What changes is your company
planning to make to improve theskills and expertise of your IT
security team in 2020?

We will invest heavily intraining our existing staff

50%
46%

We will use more managed services
We will hire more people withexisting security expertise
We will rely on contributions fromstaff outside the security team
We will hire more non-security
experts to staff the security team
Other

2%

Our security team will not make changes in 20209%

40%
33%
15%

010203040

Most security professionals are in agreement that they need to do better
Because of a shortage of skills, security
teams are hiring more people without
existing security expertise

Managed services are agood option for addressing
the security skills gap

2%

3%

9%

23%

13%

Strongly agree
24%

Agree somewhat
Disagree Somewhat
Strongly Disagree

65%

61%

750

Strong interest in managed services for security continues(if no ) Is your company likely toinvest in managed services forsecurity in the future?

Has your company investedin managed services forsecurity?

8%

14%
40%
60%

77%

Yes

Yes, DefinitelyNo

Yes, Maybe
No

94% would benefit from outside help
Would your company benefit from outside help (consulting, managedservices, outsourcing, etc.) in any of the following areas of security?
Security assessment64%

Pen testing55%

Vulnerability management

54%

Monitoring attack surface

40%

Security configuration management

34%

None of these—we have the needed 6%
expertise in-house
01020

30

40

850

60

7080

Tripwire is the trusted leader for establishing a strong cybersecurity foundation. We protect the world’s
leading organizations against the most damaging cyberattacks, keeping pace with rapidly changing techcomplexities to defend against ever-evolving threats for more than 20 years. On-site and in the cloud, ourdiverse portfolio of solutions find, monitor and mitigate risks to organizations’ digital infrastructure—allwithout disrupting day-to-day operations or productivity. Think of us as the invisible line that keeps
systems safe. Learn more at tripwire.com
The State of Security: News, trends and insights at tripwire.com/blog
Connect with us on LinkedIn, Twitter and Facebook©2020 Tripwire, Inc. Tripwire, Log Center/LogCenter, IP360, Tripwire Axon and others are trademarks or registered trademarks of Tripwire, Inc. All other product and company
names are property of their respective owners. All rights reserved.
BRDRSG2a2001