62% of CISOs think the global cybersecurity talent shortage will get worse over the next five years, according to Global Snapshot: The CISO in 2020, a report that explores the role and demographics of CISOs.

The report by Marlin Hawk, an executive search firm, suggests that the demands of such a rapidly evolving role mean that senior candidates often lack the right level of technical knowledge (34%), don’t have the right experience (30%) or simply aren’t the right cultural fit (10%).

The report finds that information security is more than a technical issue; it blends risk, strategic vision and knowledge of the threat landscape with people and data management.

Three major findings of the report:

• There is a global talent shortage: 66% of respondents say they are struggling to recruit senior talent because candidates lack the right level of technical knowledge (34%), don’t have the right experience (30%) or simply aren’t the right culture fit (10%). This is particularly prevalent in APAC where 91% say they find it difficult to find the right talent, compared to 61% in the UK and 54% in the US. 

• The CISO role is dynamic and in a state of evolution: 73% of respondents report that they are under 45 years old and 29% took the role because they want to be at the forefront of one of the biggest business growth areas.

• There is rarely a clear upward progression from the CISO role: A symptom of this is that 85% of senior cybersecurity professionals are either actively looking for a new role or would consider one if approached. The average tenure in CISO roles globally is four years.

The report also contains interviews with CISOs from multinationals including Boeing, Zalando and ING. On the challenges CISOs will face in 2020, Ron Green, CSO at Mastercard, says; “Machine learning and automation are going to be really helpful to current and future CISOs. Businesses are still going to need smart humans on security but already the humans that are in our security operations centers are being overwhelmed with things they have to monitor and you can't simply keep putting in more people because there aren't enough people already.”