Training & Security Leadership
Security Leaders Face Gaps, Not in Their Org Charts, But in Their Team’s Skills
Concerns about the skills and capabilities of cybersecurity teams have for the first time overtaken worries about headcount and unfilled vacancies among chief information security officers, according to a new survey.
See Also: How AWS-Qualys Alliance Powers Risk-Aware Cloud Security
The shift highlights the challenges CISOs face in addressing new threats driven by emergent technologies like artificial intelligence and quantum computing – and the difficulty they confront identifying and quantifying skills among their existing staff. That’s even more so the case for new recruits.
“Not having the right staff” was picked by 60% compared to only 40% who chose “not enough staff,” in the SANS/GIAC 2026 Cybersecurity Workforce Research Report, which surveyed 947 CISOs from a range of companies across the globe.
The need for CISOs to address the wave of rapid AI deployment by corporations, securing “a whole new technology stack, implemented across every function of the company,” highlighted “gaps in the skills of the team,” said Rob T. Lee, SANS chief of research. CISOs are wrestling with how to address these swiftly emerging new tasks. “Do we need new positions? Are these additional duties [for existing staff]? How do we identify and measure success?” Lee said.
“You can’t hire your way to success,” he said. There aren’t enough highly skilled cybersecurity professionals on the market and those that are, are prohibitively expensive.
“Most CISOs are really trying to figure out, if they can’t get the budget to hire someone, can they at least get budget to increase the skills” of the existing team, Lee said.
The exact nature of the skills gap was unclear, he acknowledged, “It is hard to assess through a simple survey question.” He added that SANS is developing more detailed follow up questions for a subsequent survey.
The lack of clarity about the skills gap underlines the challenges CISOs face in identifying and validating the skills they need, said Marling Engle, CEO of Cyberstar, which makes automated cyber talent management platforms.
“If you look across the marketplace, you’ll find companies that are trying to hire for entry level positions with advanced requirements because they don’t have a good match for what is in the field and what they actually need,” Engle said.
The National Initiative for Cybersecurity Education in the United States and other organizations abroad have produced cyber skills and roles frameworks. “Just pick one,” Engle urged.
The frameworks are “just a standardized way to talk about the information,” Engle explained. Training organizations such as SANS typically map the courses they offer to the NICE or other frameworks, so trainees can easily see which jobs they are qualifying themselves for.
The frameworks’ standardized language also helped avoid what Engle called “title drift,” which he described as “I want to be this [cool role]. So I say that’s what I am, but that’s actually not what I’m doing on a day to day to day basis.”
Title drift is all too common in cybersecurity, he said. “Imagine if you did that in medicine. This guy’s a heart surgeon, but it turns out he was actually a pediatrician and they just gave him the heart surgeon title.”
Using a standardized framework, Engle said, allows CISOs to “correctly size the positions, because they know what they need done, and the framework identifies the skills, the knowledge and the abilities required. … So it turns out actually, I don’t need a security architect. I need a SOC analyst.”
But even standardized skills don’t qualify staff to succeed in a cybersecurity role, because of the nature of that role, which is to keep the organization operating under cyberattack, said JC Vega, a cybersecurity consultant and retired U.S. Army colonel.
That imperative means cyber defenders have to keep the big picture of the organization in mind, said Vega, who runs the cyber networking group called A Wee Dram.
“I can teach anyone IT, or cyber. I can’t teach you operations to get that big picture of the organization. That you have to learn by working there,” he told ISMG.
The cybersecurity mission lies at the intersection of technical defense and operational resilience, Vega said. Understanding why networks and systems had to be defended – and what would happen if the defense failed – is something hard to train for or certify.
“If you understand that, it’ll shape your decision-making. It’ll shape how you’re structured to be resilient, because you’re not maintaining the system for the system’s sake, you’re maintaining it for the sake of the operation,” he said.
Vega said he is concerned that the generation of cybersecurity professionals now retiring has that hard-won operational understanding. Almost none of them started their professional lives in cybersecurity, because the field had only really matured in the last 10 or 15 years.
“Now you have people coming up who are all cyber, and they’ve never done anything else. They don’t have the operational experience,” he said.
Operational experience isn’t the only thing cyber professionals need in addition to their technical skills, according to John Felker, a former Coast Guard member who served as the deputy chief of service cyber command and went on to work for CISA, eventually retiring as the agency’s assistant director in 2020 and going into private practice.
When Coastie cadets graduate, their first assignment traditionally is a junior officer role on a ship. As a newly commissioned ensign, they get to do a wide variety of tasks connected with crew morale and welfare, leading some to derisively call the role the SLJO, for “sh—y little jobs officer.”
But the primary purpose of such an assignment “is to learn how to drive the ship, and how to be a deck watch officer,” Felker said. “That’s where you learn leadership,” he said, including the vital skills of listening and learning. “One of the questions I always used to ask [of a job candidate] was ‘How well do they listen to their subordinates? How well do they listen, integrate and understand what their subordinates are telling them, whether it’s business or cyber?'”
Currently, Felker added, many graduating cadets get their first assignment ashore. The Coast Guard Academy’s first graduate from its newly minted cybersecurity program went straight into a cyber role.
“Now, is that a mistake?” asked Felker, “It remains to be seen. My perspective is, from a leadership perspective, it is. Because if you take a cadet out of the academy and put them on a ship, and teach him or her those leadership skills, he or she is going to do better when they do get into a cyber role.”
“Now, there’s a challenge with that, too,” Felker acknowledged, because two years on a ship was long enough for newly acquired cyber skills to atrophy or become outdated.
He proposes a “dual track” approach. “One for someone who wants to be a superstar in cyber or in AI, and stay focused on that track; and another who says, ‘I’m gonna have all these AI and cyber skills in my toolkit, but I want to go over here and work in the business side of things’. … I think some companies are starting to develop their ability to do that and create those two tracks,” he said.
There is an uncomfortable truth about the cybersecurity profession, said one executive from a large corporation, who was granted anonymity because they were not authorized by their employer to speak to the media: The profession often demands a more than full-time commitment, especially from beginners.
“At least early in your career, this is not a nine-to-five job,” the executive said. “The pace of change across threats, technology and attack surface forces you to keep learning outside of standard hours. If you don’t, you fall behind quickly.”
The executive emphasized that the differentiator is not access to training or certifications, but mindset.
“The people who stand out have a level of curiosity you can’t manufacture. You can teach tools. You can’t teach someone to care enough to go deeper.”
What concerns the executive most is how this dynamic is showing up at the enterprise level.
“In a lot of organizations, you’re seeing a shift toward coordination over capability,” they said. “There are strong program structures, but not always the technical depth behind them. That gap doesn’t show up in org charts, it shows up in missed detections, slower response and risk that isn’t fully understood until it matters.”