Ben Stewart
Cyber threats are escalating rapidly, with a staggering 39% of UK businesses experiencing a cyberattack in the last 12 months according to the UK Government's Cyber Security Breaches Survey 2022. For medium and large businesses, the average estimated cost per cyberattack was £19,400 – a sizable figure! Recent high-profile breaches hitting Royal Mail and the Electoral commission potentially exposing personal details of millions of customers shows how the threat is very real and how a single vulnerability can cripple operations.
Building a Strong Cyber Security Team – in 4 Simple Steps
So how do you build an elite cyber security team equipped to defend against the latest threats? Here are four things that should be your priority:
- Cyber security as part of the bigger mix: It may seem obvious, but even in times of economic uncertainty, cyber security is an essential investment for any business. Maintaining a strong approach to security can help you protect your assets, reputation, and customers from potential threats and losses.
- Versatility and agility in your team: Have a solid core team and augment it with on-demand experts to tackle specific challenges. Be prepared with the right skills to react to incidents swiftly and effectively.
- Learning and upskilling: Cyberattacks evolve constantly, so training needs to keep pace and not be a one-time event. Do be aware of the challenges of upskilling internal teams, such as cost, effort, budget constraints, and data reporting.
- Get out in the real world: Ensure your cyber staff keep their skills sharp and relevant. Things like attending conferences, hackathons, and hands-on workshops with ethical hackers or penetration testers are hugely valuable for team-wide knowledge building.
Neglecting any of the above opens you up once again to risks: the dreaded data breach, malware, DoS, phishing, ransomware or other serious vulnerability exploit.
Retaining Specialist Cyber Security Talent
Once you’ve built your team, the next step is retaining them. This is crucial, as losing cyber security specialists can be a crushing blow for an organisation working to overhaul a cyber security set up and leave dangerous gaps in defences.
As well as competitive compensation, it will come as no surprise to many and has been widely documented by the likes of Harvard Business Review and Forbes experts that career development opportunities, flexible work arrangements, strong culture, are also strong factors towards increased retention.
The majority of contractors I work with are driven by challenging, innovative work. They want assignments that allow them to showcase expertise, expand skills, and drive organisational success and perform their best when provided with clear expectations, regular feedback, and recognition.
The Potential Role of Specialist Recruitment Consultancies
To defend against rapidly evolving cyber threats, decision-makers, policymakers and business leaders need guidance from specialists immersed in the latest attacks, technologies, and best practices. Strong in house cybersecurity teams offer many benefits, including institutional knowledge, continuity and cost savings. However, consultancies can complement internal capabilities in a number of ways:
- Filling niche skill gaps: Consultancies focus is on maintaining talent pools with less common, highly specialised expertise like incident response or threat intelligence. This allows filling short-term needs without hiring full-time.
- Handling temporary spikes: Consultancies can quickly mobilise additional talent when there are temporary increases in workload like special projects or technology transitions. This provides flexibility and scalability. The fastest I personally have ever had someone on site is within a day!
- Independent assessment: External experts may offer an independent perspective to evaluate current security posture and readiness, avoiding blind spots via a fresh pair of eyes.
- New solutions: Consultancies stay up to date on emerging cybersecurity technologies, tools and techniques which in-house teams may miss. They can advise on new solutions and innovations.
- Cost trade-offs: While consultancy rates are often higher per hour, they allow paying only for actual hours worked. In-house staff may have downtime between security projects.
The key is determining when your organisation is most likely to benefit from external support vs investing in your internal capabilities. Assessing the maturity of your cybersecurity programme, existing skill gaps, workload variability and budget can inform the right balance for your needs.
Now is the Time to Level Up Your Cyber Security
If you’re looking to level up your organisation's cyber security or are a professional looking for your next role, learn more about Empiric's capabilities and explore open positions by visiting our dedicated cyber security page.
Our expert recruiters are embedded in the communities we serve and can help assess your readiness while matching you with the best roles.
Be sure to subscribe to our newsletter below and also connect with me on LinkedIn.
