The Chartered Institute of Information Security (CIISec) has revealed the findings of its annual State of the Security Profession report, showing that more than half (54%) of cybersecurity professionals believe that cybercriminals will benefit more from AI than the security industry will. The survey-based report shows:
- AI influence: more than half (51%) of those surveyed believe that AI and machine learning will be the most influential technology in the cybersecurity industry over the coming year. Zero trust and cybersecurity hygiene basics were the next closest technologies/principles, both with just 7%.
- Winners and losers of AI: 89% of cybersecurity professionals say AI will benefit attackers, compared to 84% who say it will benefit the cybersecurity industry itself. Unskilled workers (26%) and older people (39%) will benefit the least. Less than half (48%) think AI will benefit society as a whole.
- Risk (un)awareness: almost half of security professionals (44%) believe their organization is unaware of the risks of AI and doesn’t have policies in place to ensure safe use. Despite this, 85% are at least considering the use of AI in their role.
Beyond the risk of AI, the research also looked into broader cybersecurity industry trends, including:
- Breaches are handled better than budgets: whilst 56% of security professionals believe that the industry is doing better at defending against and dealing with breaches, this isn’t sustainable, as 80% of cybersecurity professionals believe security budgets are rising too slowly, flatlining, or declining. Just 11% think budgets are rising in line with threat levels and a record number (19%) believe the industry will stagnate over the next three years.
- Poor practice lasts long in the memory: when asked about well and poorly-handled breaches, just 57% could name a breach that was dealt with well, whereas 97% could remember a poorly managed security incident. The mismanaged breaches also lived long in the memory, tending to have occurred longer ago than well-handled incidents, showing the lasting impact of poor practice.
- Lack of diversity widening the skills gap: when comparing which poses the greatest operational challenge between people, process and technology, people (72%) was top, compared to process (17%) and technology (11%). Specifically, analytical thinking and problem-solving skills are most in demand. However, the security industry remains an exclusive sector, with only 19% of professionals entering the industry without a degree and women making up just 10% of the workforce. Retention is also an issue, with just 41% predicting they’ll be in the same role in two years’ time.
The survey comprised of more than 300 CIISec members, fellows, and wider cybersecurity industry professionals.
