This varies by industry and even by employer. Cybersecurity consulting firms consist mainly of individuals who work on these issues because they make money by offering cybersecurity solutions to other organizations. But employers in other industries employ cybersecurity professionals only to ensure that their main functions continue uninterrupted, which might be making profits or providing public services. Most companies and agencies aren't eager to publish their cybersecurity headcount lest it encourage cybercriminals to exploit weaknesses.