Are Generalists in Cybersecurity a Dying Breed in 2024-2025?

In my experience, one of the biggest frustrations businesses face today is finding the right cybersecurity talent. The shortage is not just about finding people—it’s about finding the right people who are go-getters. In this article, I’ll dive into three of the most critical challenges: the cloud security talent shortage, the rising importance of soft skills, and the demand for specialized cybersecurity roles. I’ll share insights from what I’ve seen over the years and provide a balanced view of both the pros and cons. By the end of this article, you’ll have a clearer understanding of how these challenges affect businesses today and what you can do about it.

1. The Cloud Security Talent Shortage: Why It’s Harder Than Ever

Personally, I feel that cloud security is where the talent shortage hits the hardest. The rise of cloud computing has brought enormous opportunities for businesses to scale, but it has also introduced unprecedented security challenges. Fifteen years ago, cloud security wasn’t even on the radar for most businesses. Today, it’s the foundation of most organizations’ IT infrastructure. But here’s the problem: we don’t have enough cloud security experts to go around.

From my perspective, this is a double-edged sword. On the one hand, businesses have access to tools and platforms that allow them to grow and innovate at lightning speed. On the other hand, without the right cloud security professionals, these businesses are left vulnerable to attacks. What I’ve come to realize is that while there are more certifications and training programs available now than ever, the demand still far exceeds the supply.

Contrast that with a decade ago when a single IT generalist could manage a company’s security needs. Now, companies need cloud specialists who understand the intricacies of AWS, Azure, and other platforms. I’ve seen managers struggle to hire people with this level of expertise, and as a result, they sometimes rely on outdated security measures that simply don’t work in today’s cloud-first wo.rld.

If you’re having trouble hiring cloud security talent, focus on training your existing staff. Certifications are easier to obtain now, and upskilling your current team might be a faster, more reliable solution than trying to hire externally.

2. The Rise of Soft Skills in Cybersecurity: Are We Forgetting the Human Element?

In my honest opinion, one of the most overlooked crises in cybersecurity today is the lack of soft skills. Ten or fifteen years ago, cybersecurity was all about technical know-how. I’ve observed that today’s cybersecurity landscape requires much more than that. It’s not just about protecting systems anymore—it’s about leading teams, communicating risks, and aligning security strategies with business goals.

What I’ve learned over the years is that the best cybersecurity leaders aren’t always the ones with the most technical certifications. They’re the ones who can explain complex security issues to non-technical stakeholders. They can rally a team and make quick decisions during a crisis. In contrast, I’ve seen brilliant engineers struggle to move up in their careers because they lack these vital soft skills.

That’s not to say that technical skills aren’t important—they absolutely are. But from what I’ve gathered, the industry hasn’t done enough to emphasize the importance of communication, leadership, and problem-solving. This is especially true for architects and managers, who need to bridge the gap between technical teams and executives.

Develop these soft skills within your cybersecurity team. Don’t just focus on technical certifications—invest in leadership and communication training as well (ensure at all costs to avoid engaging with Psych-driven vocational learning). Personally, I feel that this is what separates a good security team from a great one.

3. Specialized Cybersecurity Roles: Why You Can’t Rely on Generalists Anymore

I can confidently say that one of the biggest shifts I’ve seen in cybersecurity over the last decade is the need for specialized roles. Back in the day, you could have a generalist IT administrator who handled everything from network security to system updates. Today, that’s simply not feasible. As threats have become more sophisticated, so too has the need for specialized cybersecurity roles.

In my experience, roles like cloud security architects, DevSecOps engineers, and vulnerability management specialists have become indispensable. Ten years ago, these positions didn’t even exist! Now, they’re critical to maintaining a strong security posture. I’ve seen businesses that try to rely on generalists fall behind, simply because the scope of cybersecurity is too broad for one person to manage.

However, in my humble opinion, there’s a downside to this specialization. It’s expensive. Hiring multiple experts to fill all these roles can be financially unfeasible, especially for small and medium-sized businesses. This is where I’ve noticed a real contrast between large enterprises and smaller companies. Large enterprises can afford to have a full team of specialists, while smaller companies struggle to keep up.

One solution I’ve seen work well is partnering with managed security service providers (MSSPs). This allows businesses to access specialized skills without the high cost of full-time employees. It’s not a perfect solution, but from my perspective, it’s a smart way to bridge the talent gap until more professionals enter the workforce.

Recent Cybersecurity News Stories

• AI and Automation Threats Intensify in 2024 AI has revolutionized many sectors, including cybersecurity. However, it’s also empowering cybercriminals with more sophisticated tools. For example, AI-based phishing attacks are becoming harder to detect as hackers use machine learning to eliminate traditional signs like poor grammar or broken English. The rise of AI-powered malware, which dynamically adapts to avoid detection, has added another layer of complexity. Moreover, deepfakes are now being used to impersonate authoritative figures, leading to widespread disinformation and security breaches. Addressing these threats requires both advanced AI tools for defense and human expertise to navigate the evolving threat landscape.

• The Cybersecurity Talent Shortage and Upskilling Solutions The ongoing shortage of skilled cybersecurity professionals continues to challenge businesses, with the global gap now nearing 4 million. Many organizations are turning to upskilling internal talent to bridge this gap. In fact, companies are increasingly developing cybersecurity roles within their existing teams, rather than relying solely on external hires. While this shortage isn’t expected to improve soon, investment in training and upskilling is gaining momentum as a way to strengthen cybersecurity defenses. Upskilling programs are particularly valuable for addressing gaps in cloud security and AI defense.

• Soft Skills and Cybersecurity: A Critical Component While technical skills are essential, soft skills like communication, problem-solving, and leadership are becoming increasingly important in cybersecurity. Many organizations find that their cybersecurity teams lack the ability to communicate complex security issues to non-technical stakeholders effectively. This gap in communication skills can hinder collaboration and lead to misunderstandings between departments. The solution? Investing in both technical and soft skill development through mentoring programs and corporate training can significantly improve team performance and retention.

I hope this article has shed some light on the ongoing cybersecurity talent gap and the importance of bridging it through upskilling, cloud security expertise, and the development of soft skills. My goal was to offer a balanced perspective on the challenges and solutions businesses face, from AI-driven threats to the growing need for specialized roles.

I’d love to hear your thoughts! Has your organization taken steps to address these challenges? What strategies have worked for you in finding and retaining the right cybersecurity talent? Feel free to share your experiences in the comments below.

Remember, cybersecurity is an ever-evolving field, and your insights could help others tackle these pressing issues more effectively. Thanks for reading, and I look forward to hearing your ideas!

Warmest Regards, Shawn May

Here are technical definitions to complement this content:

1. Zero-Day Exploits: Vulnerabilities in software that are unknown to the vendor and exploited by attackers before a patch is available.

2. Advanced Persistent Threats (APTs): Prolonged and targeted cyberattacks where an intruder gains access to a network and remains undetected for an extended period.

3. Penetration Testing: A security practice where experts simulate attacks to identify vulnerabilities in systems before malicious attackers do.

4. Threat Modeling: A process used to identify, understand, and mitigate potential threats to a system or network.

5. Zero-Trust Security Model: An approach where no user, device, or application is trusted by default, even if they are inside the network. It requires continuous verification of identities and permissions.