AI a force multiplier for the bad guys, say cyber pros

Beyond the cutting edge

As always, CIISec’s annual report also explored broader security industry trends, where it found some areas of general improvement, but also much to be concerned about.

Whilst the AI revolution will undoubtedly benefit many business functions, it’s presenting more questions than answers for cyber security professionals

For example, average sector wages now stand at over £87,000, up £25,000 from its first such report covering the 2016-17 period – an indication that, for security professionals at least, earnings growth has not only kept up with, but outpaced inflation.

Security professionals also tended to believe that, as an industry, they were doing better at defending against and dealing with cyber incidents, but many said this is unsustainable – 80% think their budgets are either rising too slowly, flatlining, or outright declining, compared with 11% who think budgets are rising in line with threat levels. Many believed a period of stagnation in security may lie ahead.

Coupled with this, almost a quarter of cyber security professionals said they felt overworked, and over half said they had had trouble sleeping due to the pressures of the job. And well they might, because when asked about well-handled and poorly handled incidents, just 57% could name one that had been handled appropriately while 97% could remember a mismanaged breach.

Talent gap widened by diversity failings

Finally, this year’s report also explored how a lack of attention to diversity within the security sector is widening the skills gap. Between people, processes and technology, it is people, said CIISec, that pose the greatest operational challenge, with analytical thinking and problem-solving skills in particular shortage.

The sector also remains an exclusive one, with only 19% of entry-level cyber professionals not holding a degree, and only 10% women. Retention is also a growing issue, with only 41% of cyber professionals predicting they would be in the same role two years from now.

“Cyber security professionals face so many challenges, many of which – such as the economy and the advanced threat landscape – are out of their control. But bridging the skills gap with improved recruitment and retention is one area where the industry can exert influence and drive improvements,” said Finch.

“If the cyber security industry wants to attract and keep its talent, it must diversify recruitment practices, hiring based on skills rather than experience or qualifications. Issues such as stress and career progression will also need to be addressed to help retain staff. With an ever-widening skills gap and more advanced threats driven by AI, failing to attract talent to the industry will hinder efforts to make the world a safer place, both today and in the future.”