Only 1 cyber security professional for every 240 Aussie business, says report

As threats of data breaches continue to stoke fear among Australian organisations, cyber security has become a staple in workplace priorities. But is this “minuscule” industry reliant on skilled migrants stretched too thin?

The worrying shortage of technical cyber security skills among Australians is beginning to produce some anxiety around the cyber security industry’s ability to maintain and protect organisations from the rising threat of bad actors, data, and cyber breaches.

StickmanCyber has released its report, Australia’s cyber security and Technical Skills Gap, which focuses on this very sentiment. There are only 11,387 cyber security workers in the entire country in vital roles such as penetration tester, cyber security engineer, cyber security analyst, cyber governance risk and compliance specialist.

Describing the industry as stretched too thin would be an understatement. According to the report, only 3 per cent of all Australian ICT professionals are currently in specialised cyber security positions, meaning that there is just one pro for every 240 Aussie businesses.

If you put the data in a broader context, based on there being 2.6 million businesses in Australia, there is roughly one ICT worker for every seven businesses.

“Australian cyber security is growing quickly, but there is a worrying shortage of technical cyber security skills, and very few Australians are in dedicated cyber security roles such as penetration testing,” said StickmanCyber chief executive and founder Ajay Unni.

“Our estimate of 10,000 technical cyber security pros is woefully short of what’s needed to combat modern cyber security threats. It’s also incredibly low when you consider what an exciting and dynamic industry this is.”

Of these cyber security professionals, very few are homegrown talent, with some arguing that there is an over-reliance on skilled migrants who are seemingly spearheading the cyber security industry in Australia.

The report showed that over half (51 per cent) of cyber security professionals were born outside of Australia. Although 30 per cent of the Australian population at the moment were born overseas, among all IT professionals, 54 per cent were born outside of Australia. In terms of cyber security architects, a whopping 62 per cent of workers in this role were born overseas.

“There are no quick fixes to this problem. Right now, migrants with technical skills are filling a lot of technical roles, but Australia needs to incentivise young people and students to pursue a career in cyber.

“Companies also need to improve working conditions and reduce burnout to ensure that people stay in the field. This is how it fills the gap long term. In the short-term, businesses that cannot find the skills they need in-house must look to trusted third-party security service providers who have the skills they lack,” said Unni.

India was the leader when it came to contributing the greatest proportion of non-Australian-born ICT and cyber security workers. More than 60,000 out of the total 376,000 ICT workers were born in India (16 per cent).

While the risk of cyber security threats becomes more and more complex, a skills shortage in such an important space is frankly unacceptable. Encouraging the youth to consider joining the industry is an endeavour that needs more urgency, as this space will continue to be crucial to Australian business practices going forward.

“The Australian government wants to incentivise STEM education, but it needs to go a step further and encourage more people into the cyber security industry specifically, which is a major push in countries like the UK. In the long term, we cannot rely on technical skills coming in from abroad,” said Unni.