While some of the issues covered above are well understood and grounded in a solid evidence base, others remain less illuminated with little more than anecdotal evidence in support. This suggests a requirement for further research to build a broader and deeper selection of data which can be used to make international comparisons and inform decisions about cyber security professionalisation.
The Cyber Security Skills in the UK Labour Market report published annually by the UK government remains best in class for this type of research. While some efforts have been made to emulate it in other countries, the international community would greatly benefit from increased proliferation of this research to build a common understanding of cyber security workforce challenges. Such research, when conducted using comparable methodologies, would also be a fundamental part of creating a shared glossary of terms as well as tracking progress in cyber security professionalisation.
In addition, there is need for a new piece of research investigating the future cyber security workforce, with a focus on quantifying the workforce at various time horizons. This would help ensure supply (from education and training systems) today can be matched to future demand. It could also be used to identify cyber security roles, if any, that are likely to be eliminated by new technologies. A core principle to bear in mind during any research into skills is that there is a difference between individual perception of needs and organisational perception of needs. It is therefore crucial to have a diverse selection of voices represented in research to collect a broad range of views.