全球智库信息集成服务系统

Sudden demand creates scarcity, competition, and crisis

• Whenever rapid demand increases hit a profession with nontrivial skill and/or education requirements, economic theory suggests that rapidly rising compensation packages and strong competition for workers can be expected.

Educational initiatives are already addressing the cybersecurity demand

• In response to earlier indications of burgeoning demand for cybersecurity professionals, there has already been a large increase in education, notably government-supported education, but also an increase in the number of computer science majors.

It's normal for the labor market to lag demand and education initiatives

• Theory suggests and experience confirms that the market may take a long time to respond to unexpected increases in demand.
• In the short term, many large organizations have found innovative ways of meeting the demand for cybersecurity professionals through internal recruitment and training, as our interviews have found.
• Theory suggests and our interviews confirm that even organizations that can meet most of their needs internally still face difficulties in recruiting or retaining cybersecurity professionals in the upper tier.

The best steps may already have been taken

• The difficulty in finding qualified cybersecurity candidates is likely to solve itself, as the supply of cyberprofessionals currently in the educational pipeline increases, and the market reaches a stable, long-run equilibrium.

There is a general perception that there is a shortage of cybersecurity professionals within the United States, and a particular shortage of these professionals within the federal government, working on national security as well as intelligence. Shortages of this nature complicate securing the nation's networks and may leave the United States ill-prepared to carry out conflict in cyberspace.

RAND examined the current status of the labor market for cybersecurity professionals — with an emphasis on their being employed to defend the United States. This effort was in three parts: first, a review of the literature; second, interviews with managers and educators of cybersecurity professionals, supplemented by reportage; and third, an examination of the economic literature about labor markets. RAND also disaggregated the broad definition of "cybersecurity professionals" to unearth skills differentiation as relevant to this study.

In general, we support the use of market forces (and preexisting government programs) to address the strong demand for cybersecurity professionals in the longer run. Increases in educational opportunities and compensation packages will draw more workers into the profession over time. Cybersecurity professionals take time to reach their potential; drastic steps taken today to increase their quantity and quality would not bear fruit for another five to ten years. By then, the current concern over cybersecurity could easily abate, driven by new technology and more secure architectures. Pushing too many people into the profession now could leave an overabundance of highly trained and narrowly skilled individuals who could better be serving national needs in other vocations.

• Chapter One

  Why Has Demand Risen Sharply?

• Chapter Two

  What Others Have Observed

• Chapter Three

  Findings from Interviews and Statistics

• Chapter Four

  The Economics of the Cybersecurity Labor Market

• Chapter Five

  Upper-Tier Cybersecurity Professionals and Policy Options

• Chapter Six

  Conclusions