Eurobarometer on Cyberskills

A newly published Eurobarometer survey highlights the growing shortage of cybersecurity skills across the European Union, calling for immediate action to boost the number of cybersecurity specialists and heighten cybersecurity awareness among staff in companies across the EU.

The survey aligns with recent findings from a foresight report by the EU Agency for Cybersecurity (ENISA), which highlighted the cyber skills gap as a significant factor contributing to increasing cyber threats. These threats pose major risks to the operation of network and information systems and the Single Market's overall integrity.

The results

The Eurobarometer survey on cyberskills highlights a significant awareness of the importance of cybersecurity among companies, with 71% recognizing it as a high priority. However, the survey reveals a gap in action, with 74% of companies not providing any training or awareness programs for their employees.

Furthermore, 68% of companies believe no training or awareness raising about cybersecurity is needed. Key barriers include a lack of awareness of relevant training opportunities (16%) and budget constraints (8%).

Key Findings

Hiring Difficulties

Companies are experiencing substantial challenges in recruiting staff with the right cybersecurity skills:

45% have difficulties finding qualified candidates.
44% cite a lack of applicants.
22% identify a lack of awareness about cybersecurity roles.
16% mention budget constraints
Other challenges include the need for continuous training (19%), rapidly changing technology (19%), security clearance requirements (16%), high turnover (13%), and competition with other companies (13%).

Qualification and Certification

76% of employees in cybersecurity-related roles lack formal qualifications or certified training.
57% of cybersecurity responsibilities are absorbed into existing roles from non-cybersecurity positions.
34% entered the role from a non-cybersecurity-related role.
18% were recruited from a previous role in cybersecurity.
17% are career starters, such as graduates.
10% entered through other means.

Diversity and Inclusion

70% of respondents agree that diversity and inclusion are important in cybersecurity roles within their companies.
However, 56% of companies do not have any women in cybersecurity roles.
Of the companies that do, 32% have one woman employed, 6% have two, and only 1% have three to five or more women.

Detailed Analysis

Hiring Difficulties in Cybersecurity

The survey indicates that finding appropriately skilled candidates is a significant hurdle for companies. The primary challenges include:

Qualified Candidates (45%): A shortage of candidates with the right skills.
Lack of Applicants (44%): Insufficient number of candidates applying for cybersecurity roles.
Awareness (22%): A general lack of awareness about the importance and nature of cybersecurity roles.
Budget Constraints (16%): Financial limitations affecting the ability to recruit and retain skilled professionals.
Continuous Training (19%): The need for ongoing training to keep up with evolving cyber threats.
Rapid Technology Changes (19%): The fast pace of technological advancements requiring constant skill updates.
Security Clearance (16%): Difficulties meeting security clearance requirements.
Turnover (13%): High turnover rates making retention challenging.
Competition (13%): Intense competition with other companies for skilled candidates.

Qualification and Certification in Cybersecurity Roles

A significant portion of the cybersecurity workforce lacks formal qualifications:

76% of employees in cybersecurity roles do not hold formal qualifications or certifications.
Many employees (57%) take on cybersecurity responsibilities in addition to their existing non-cybersecurity roles, highlighting the multifunctional nature of cybersecurity duties in many organizations.
Recruitment often comes from non-cybersecurity backgrounds, with 34% transitioning from unrelated roles and 18% from prior cybersecurity roles.
Entry-level positions are filled by recent graduates (17%), indicating a growing interest in cybersecurity careers among new professionals.

Diversity and Inclusion in Cybersecurity

Diversity and inclusion remain critical yet under-addressed aspects of cybersecurity:

While 70% of companies acknowledge the importance of diversity and inclusion, implementation is lacking, particularly regarding gender diversity.
56% of companies report having no women in cybersecurity roles, pointing to a significant gender gap.
A small fraction of companies employ women in these roles, with only 32% having one woman and even fewer having multiple women in cybersecurity positions.

Attachments

The detailed survey results and additional data are available in attached documents, providing further insights into the state of cybersecurity skills and workforce diversity across companies in Europe.