More respondents in this year's study indicated they have understaffed IT security functions than in 2013 (75% vs. 70%). Specifically, only 25% of respondents said their organizations have no difficulty attracting qualified candidates, compared to 34% in 2013. Only 28% reported their organizations have no difficulty retaining qualified candidates compared to 42% of respondents in 2013. Compounding the issue, 76% believe machine learning and artificial intelligence tools and services aggravate the problem by increasing the need for more highly skilled IT security staff.

Forty-one percent of organizations said the inability to properly staff security positions increased investment in cyberautomation tools. Yet despite the hype around this technology, only 26 % of organizations currently use automation tools as part of IT security, and only 15 % stated that AI is a dependable and trusted security tool for their organization.

“One of the biggest barriers to a strong security posture is attracting and retaining the right people that can deal with complex and serious internal and external threats to the organization,” Dr. Larry Ponemon, chairman and founder of the Traverse City, Mich.-based Ponemon Institute, said. “This research reveals that despite the adoption of advanced and automated tools, the skills gap has increased, leaving organizations more vulnerable than ever before.”

Additional survey findings:

• Sixty-three percent said human involvement in security is important in the age of automation.
• Sixty percent believed automation will improve their IT security staff's ability to do their jobs because it will enable them to focus on more serious vulnerabilities and overall network security (68% of respondents).
• Only 23% said automation will reduce the headcount of their IT security function.
• Sixty percent indicated on-the-job experience is more in demand than a degree.

“As cyberthreats and threat actors grow in numbers and expertise, organizations worldwide rely on both highly skilled staff and advanced technology to combat these threats,” Tim Helming, director of product management at DomainTools said. He added, that while research found automation great for certain low-skill tasks, additional work on more advanced threats requires high-skilled security professionals, which continue to be in very short supply.

The research found an understanding of potential cybersecurity threats is important for entry-level and highly experienced job candidates. Respondents said their organizations have great expectations that highly experienced job candidates will bring more general knowledge to their positions.

The top three categories of general knowledge for entry-level candidates are an understanding of potential cybersecurity threats (39%), familiarity with security regulations and standards (25%) and experience with intrusion prevention and detection systems (19%). Similarly, expect highly experienced job candidates to understand potential cybersecurity threats (85%), experience with intrusion prevention and detection systems (81%) and an understanding of information security frameworks (75%).