The cybersecurity talent shortage is often described as a recruitment problem. Vacancies remain open, qualified candidates are difficult to find and employers compete for the same experienced professionals. But recruitment alone cannot solve a shortage of experience. Employers must also create opportunities for people to acquire it.
An organisation may be able to fill a vacancy by hiring from a competitor. Across the industry, however, moving experienced people between employers does little to expand the talent pool. When entry-level roles demand several years of experience, the industry makes it harder for newcomers to gain the very capability it says is missing.
Strengthening the cybersecurity talent pool means building credible pathways into the profession and helping existing practitioners keep pace with changing demands. Universities, government and professional bodies all contribute. Businesses must take responsibility too, because much of the experience professionals need can only be developed by applying their knowledge to real-world operational problems.
Cybersecurity is learned by doing
Cybersecurity education has traditionally depended heavily on universities, professional certifications and classroom-based training. But understanding a security concept is different from applying it under pressure.
Someone can learn how an incident response process works in theory and still struggle when confronted with a simulated ransomware attack, incomplete logs, disrupted systems and pressure from management to restore operations. A penetration tester may identify a vulnerability but need support to assess whether it is realistically exploitable, what business impact it could have and how urgently it should be addressed.
These decisions require judgement, which develops through practice, feedback and progressively greater responsibility.
Employers already operate the systems and technologies that young cybersecurity professionals need to understand. They can turn that operational experience into structured learning. An anonymised incident can become an investigation exercise. A recurring security weakness can inform an attack-and-defence simulation. A difficult recovery decision can become a tabletop scenario involving both technical and business teams. Training should be overseen by experienced cybersecurity practitioners, either from within the business or from a specialist cybersecurity firm.
A well-designed training exercise should recreate the uncertainty and decision-making pressure of a real incident rather than give participants a fixed sequence of steps to follow. In a controlled cyber range, trainees can investigate a realistic attack scenario, assess its potential impact and decide how to respond, working through the consequences of their decisions.
We recently ran an exercise involving red and blue teams that allowed participants to experience both offensive and defensive perspectives, while experienced practitioners guided the session and provided feedback. The goal was to build judgement and operational readiness in an environment where mistakes were part of the learning process rather than a risk to the business.
Employers need to build the talent they want to hire
Employers need to distinguish between the skills a candidate must bring and those the organisation can teach. By recognising transferable skills and providing training to address gaps, companies can create meaningful entry points for graduates, career switchers and professionals from adjacent disciplines such as networking, software engineering, IT operations, data and risk management.
Network engineers understand infrastructure. Developers may have the technical foundation to move into cybersecurity. Someone working in audit or enterprise risk may be well suited to governance and compliance roles.
Those backgrounds do not automatically qualify someone for every security role. They do provide starting points that recruitment processes can overlook when previous cybersecurity job titles and long lists of certifications become the main screening criteria.
Creating more entry-level opportunities is only the first step. Employers should provide structured pathways that combine technical training, mentoring and supervised practical exposure, progressively building operational experience and capability.
There is a cost. Mentoring takes experienced staff away from immediate delivery, and employees may leave after being trained. Those concerns deserve attention, but they do not remove the need to develop people. An industry in which every employer waits for someone else to provide experience will continue to compete for a constrained pool.
Training must be connected to the work
Training should also offer opportunities for employees to work on problems outside their immediate specialism. A security operations analyst investigating a cloud incident will benefit from understanding how that cloud architecture is configured. An application security specialist can learn from seeing how vulnerabilities are exploited and handled during an incident.
Specialisation remains necessary. But understanding how different systems and disciplines connect, and the business context in which they operate, helps professionals collaborate more effectively and make better decisions.
Universities should not be expected to predict every tool, platform or attack technique that businesses will use several years after a student first enrols. Their enduring contribution is to build foundations in computing, engineering, research and critical thinking.
Talent development is part of cyber resilience
Industry can complement the strengths of academic learning with exposure to current operational challenges, the latest technologies and insights from practitioners. Businesses can provide cybersecurity practitioners as guest instructors, contribute anonymised case studies, support practical laboratories and create internship programmes where students can begin to build operational experience. Closer collaboration will help to produce a stronger talent pipeline than either industry or universities can create alone.
AI adds another reason to rethink how professionals develop. As tools take on more routine analysis and investigation, organisations must consider how newcomers will acquire the experience needed to question automated findings, decide which risks matter most and understand their potential consequences for the organisation.
Employers cannot expect an expanding supply of experienced professionals unless they help create it. Entry routes, supervised practice and continued development belong in the same conversation as security technology and operational readiness. They are part of how a business prepares to defend itself.
______
About Patrick Rudolf Dannacher:
Patrick Rudolf Dannacher is President Director & CEO of PT ITSEC Asia Tbk, the only publicly listed cybersecurity company in Indonesia. Patrick is an accomplished leader with more than two decades of experience driving innovation across finance, private equity, and cybersecurity. A graduate of the University of Applied Sciences in Basel, he began his career at STG Coopers & Lybrand AG and later advanced into senior roles across several prominent financial institutions. He later transitioned into entrepreneurship and strategic investment, building a portfolio of successful ventures in cybersecurity and technology. Today, as President Director & CEO of ITSEC Asia, Patrick draws on his international expertise to guide the company’s strategic growth and reinforce its leadership within Southeast Asia’s cybersecurity landscape.
Join our LinkedIn group Information Security Community!
