Addressing the Specialized Cybersecurity Talent Shortage
Cybersecurity threats are increasingly complex and destructive. With more devices connected to the internet than ever before, the number of exploitable vulnerabilities is expanding, and no organization is immune. One unprotected link in the security chain could enable hackers to unlock virtually limitless doors to access data. It’s become a never-ending arms race between bad actors and cybersecurity pros, and companies need cybersecurity expertise more than ever.Â
Meanwhile, privacy regulations like the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA) will soon be updated with additional rules and clarifications that bring new privacy legislation, adding yet more complexity. In addition, The American Data Privacy and Protection Act (ADPPA) was introduced to the House floor in June of this year. If passed, it could significantly affect how companies collect and use data.Â
The current and impending regulations can be complicated to understand. Failure to comply with them can carry stiff penalties. As a result, the demand for specialized experts like lawyers with cybersecurity experience is exploding, and the supply is simply not there to meet it. There are about 715,000 unfilled cybersecurity jobs in the United States alone, and the deficit is only growing as these roles become more specialized.
What options do businesses have to meet this demand?
1. Do Nothing
As with any change, there’s always the option not to react, but this is incredibly risky. Not only does this choice leave your business open to attacks, but companies also risk significant fines and litigation for not adhering to the regulatory laws. If a company suffers a breach, it may ruin its brand reputation and lose customers’ trust.
SolarWinds, for example, had to pay $40 million in damages, fines and litigation costs following a breach discovered in December 2020. Companies that ignore the need for data privacy can expect similar damages and costs down the line. In many cases, inaction could result in bankruptcy, or at least an extremely difficult recovery.
2. Hire Highly Specialized Professionals
Companies seeking to protect their customers’ data might consider hiring specialized cybersecurity professionals with both a legal background and expertise in data privacy—I’ve taken to calling these individuals ‘unicorns.’ If they even exist, the people that possess this combination of skills are scarce and expensive to hire. Moreover, it is likely that only the top 1% of companies could afford to hire them—companies like Google and Meta.
Hiring these highly specialized professionals full-time is unrealistic for most companies. However, small and mid-sized companies may be able to work with them on a consultancy basis to share knowledge with their in-house teams, enabling them access to the expertise without competing with top companies for full-time staff.Â
3. Outsource Your Security ServicesÂ
Businesses that can’t afford to hire or consult with these hard-to-find cybersecurity unicorns have other options for external resources, such as outsourced managed security services. Organizations can acquire the cybersecurity domain expertise they need from a variety of partner organizations at a lower cost than the unicorn options discussed above. And because partner organizations often have several people with deep knowledge in data privacy (and the new forthcoming regulations), cybersecurity and legal expertise, your company can get the full scale of resources you need to protect your business.
Cybersecurity partners help businesses reduce operational costs, lower the burden and burnout on their in-house team and enable companies to focus on their core business. Additionally, managed security organizations generally charge a flat monthly fee for services, making it easier to budget and control finances. You may also be able to bundle services for a better rate, depending on the type of partner you choose. And because they already have experience in cybersecurity, the onboarding time is much shorter than hiring someone full-time.
Don’t Let Cybersecurity Be the Weakest Link
Organizations must protect their customers’ data if they want to stay in business, and that means prioritizing cybersecurity. A chain is only as strong as its weakest link. If companies ignore data privacy, they could face major consequences. Breaches are only getting worse, and businesses can’t keep playing catch up. There aren’t enough cybersecurity professionals available to fill the gaps.
Businesses either need to hire in-house expertise or find a partner that can fill their current cybersecurity needs and manage new and ongoing requirements. There is no doubt that choosing a cybersecurity partner will enable organizations to more quickly improve security with less onboarding time. This approach is likely less costly than hiring highly specialized, in-house professionals. Look at your internal resources and determine whether there are any gaps you need to fill. Then, decide whether hiring some full-time or outsourcing to a trusted partner is the right option for you.
