It’s the time of the year when Girl Scouts knock on our doors and sell their infamous and delicious cookies: Samoas, Tagalongs, Do-si-dos, Thanks-A-Lot and Thin Mints (my family’s personal favorite).

The global cybersecurity workforce gap has increased to more than 2.9 million, according to (ISC)2. Fifty-nine percent of cybersecurity professionals say that the widening workforce gap puts their organizations at risk.

The cybersecurity industry has been around for more than 30 years and undergone exponential growth, but in many ways it is still defining itself in the face of evolving threats. Technology and process are predictably playing a role. But diversity of talent has also become increasingly important to the success of security organizations and is redefining the role of a cybersecurity professional.

Today, cyber breaches cost the U.S. more than $100 billion a year. While organizations are actively procuring new cybersecurity technology, they’re not investing enough in people, skills and talent. And according to ISACA, a non-profit information security advocacy group, a global shortage of two million cybersecurity professionals is expected by 2019.

For years we’ve talked about the dearth of skilled cybersecurity professionals which ISACA reports is now estimated to reach two million by 2019. Encouraging more individuals to pursue technical and engineering degrees can help address the shortage. But we can also expand the talent pool by thinking more broadly about cybersecurity and what it takes to be an expert.

When it comes to the cybersecurity talent shortage, an already troublesome situation is getting worse: The shortage is expected to grow to 1.8 million employees by 2022, which is 20 percent greater than a forecast from 2015, according to the 2017 Global Information Security Workforce Study.