New research from Isaca shows that cybersecurity teams are failing to keep up with the growing number of cyberattacks. Lack of staff and budget play a major role.

For his annual State of cybersecurityreport, Isaca has its finger on the pulse of security experts worldwide. 1,868 respondents completed the questionnaire this year. The survey shows that life hasn’t gotten any easier for security teams over the last twelve months. Two out of three respondents (68%) say their job is more stressful than it was five years ago.

The main reason for this is the complex security landscape. 41 percent say they are facing more cyberattacks. 58 percent expect an attack this year, six percentage points more than last year.

Understaffed, underfunded

In order to be prepared for the wave of attacks, sufficient investments in personnel and skills are required. Security experts also face a problem here. Six in ten respondents (61%) believe their security team is understaffed. More than half consider the budget for IT security to be inadequate. Isaca finds no connection between manning levels and the use of AI within security teams.

There are fewer open positions than a year ago, but the positions are not always filled. 19 percent of companies have openings for entry-level careers, which represents only a slight decrease compared to 2023 (22%). The number of companies with vacancies outside of entry-level positions also fell slightly from 53 percent to 48 percent. Good news for employers is that employees are choosing security and are less likely to change jobs.

The difficult economic environment is also noticeable in other ways. Many employers are more economical when it comes to training their employees. Security professionals are primarily seeing a lack of “soft skills” in their teams, with communication skills coming first (54%), closely followed by problem-solving thinking (53%) and critical thinking (48%).

“In an increasingly complex threat landscape, it is critical for us as an industry to overcome these hurdles of underfunding and understaffed teams. Without strong, skilled teams, the resilience of entire security ecosystems is at risk, leaving critical infrastructure vulnerable,” said Chris Dimitriadis, Chief Global Strategy Officer at Isaca.