Half of UK businesses suffer from a basic cyber security skills gap

Hundreds of thousands of UK businesses do not have basic and advanced cyber security skills within their teams, with an alarming 48% of companies hiring individuals without confidence in their abilities to execute basic tasks.

Setting up configured firewalls, storing or transferring personal data, and detecting and removing malware, are among the most common skills lacking in approximately 653,000 businesses.

This is in addition to 30% of businesses, or approximately 408,000, which lack advanced skills, according to an extensive government report. These more advanced areas include penetration testing, forensic analysis and security architecture.

A quarter of businesses, 27%, meanwhile have a skills gap when it comes to incident response, and do not outsource this crucial aspect of security.

To illustrate how widespread the UK skills crisis is, 64% of cyber security firms have faced problems with a technical skills gap, either among existing staff or among job applicants for vacant positions.

These include areas such as threat assessment, cyber security research, and implementing secure systems. This has had a measured impact, with a quarter suggesting this has, to a great extent, prevented them from achieving goals.

It’s compounded by the fact that 29% of firms suggesting that job applicants lack non-technical skills such as communication, leadership management skills.

The research, carried out on behalf of the Department for Digital, Culture, Media and Sport (DMCS), explores the nature and the extent of the cyber security skills gap, as well as the skills shortage, throughout 2019. These include people in security roles who lack the appropriate skills, as well as the lack of people available to work in cyber security roles, respectively

Despite the alarming nature of the findings, the skills gap is narrower compared against a similar study conducted in 2018, with the basic technical skills gap falling from 54% of businesses lacking these skills a years ago.

This is in addition to a higher proportion of businesses carrying out formal analysis of their cyber security training needs, from 14% and 22%. Similarly, more businesses now consider it essential to have incident response skills, moving from 17% to 23%.

In terms of recruitment, a third of cyber security companies which have tried to fill roles within the last three years have reported these positions are hard to fill. In 43% of cases, it’s because applicants lacked technical skills or knowledge, while in half of cases, employers found it difficult to fill holistic and general cyber roles.

“Skills gaps and skills shortages continue to affect a large number of organisations. There needs to be more investment in technical skills and training, within the cyber sector and the wider economy,” the report concluded.

“Schools, universities and training providers need to give young people and training recipients a holistic skillset, covering the relevant technical skills and soft skills that employers demand, and the ability to implement those skills in a business context.”

The labour market, meanwhile, is challenging to navigate, with employers, recruitment agencies and job applicants potentially benefitting from further guidance on career pathways, qualifications and training. Employers, meanwhile, could also benefit from broadening their recruitment practices to hire more new starters, apprentices and graduates, as well as people transitioning from sectors outside cyber security.

The report has recommended that the government more effectively joins up programmes on cyber security skills, with employers given more clarity over how different initiatives relate to one another, and how they fit into a broad career pathway.