Addressing Market Failure in Provision of Cybersecurity, Citi GPS Report

Rhea-AI Summary

Citi's report highlights a critical mismatch between the global demand for cybersecurity skills and their supply, exacerbated by increasing cyber threats and digitalization. Cyberattack costs are rising, impacting firms' operations and reputations. Between 2015-2021, cyber job postings surged 4.3 times; however, the average U.S. state sees only 2.6 postings per cyber professional, with 11% of the workforce lacking extensive experience. Regulation may incentivize skills investment but can hinder business creation. Companies are advised to integrate cybersecurity into their corporate social responsibility strategies to mitigate risks.

Positive

• Increased attention on cybersecurity can drive demand for skilled professionals, potentially boosting hiring in the long run.
• Government regulations may lead to increased investment in cybersecurity skills.
• Investment in AI-driven cybersecurity products can enhance efficiency and talent development.

Negative

• The cybersecurity skills gap remains significant, with insufficient supply to meet the rising demand.
• Rising cyberattack costs could deter new business formations and increase exit rates.

Global Supply of Cyber Skills Not Meeting Demand, Boosted by Cyberwar & Digitalization

LONDON--(BUSINESS WIRE)-- Citi published a Global Perspectives & Solutions (Citi GPS) report titled: The Cyber Problem: Causes and Consequences of the Risk in Cyber Skill Demand (citi.com). The report looks at the rising exposure to cyber threats as digital connectivity and cyber warfare increase, and how to fix it.

“Cyberattack costs have started to bite,” says Pantelis Koutroumpis, Lead Economist for the Oxford Martin Programme on Technological and Economic Change. “Apart from the direct costs, supply chain disruptions and reputational damage can be substantial. Nevertheless, firms are struggling to hire skilled cybersecurity professionals to reduce these costs.”

A firm’s exposure to cyberattacks not only depends on its own cyber resilience, but also on how resilient its partners and suppliers are to cyber risk. In other words, a firm’s cyber hirings improve the cyber safety of its partners, suppliers, and customers. In this sense, the analysis suggests that cybersecurity is a public good.

Government regulations overseeing firms’ data protection and security can be used to ensure the optimal provision of a public good. Although regulation can induce firms to increase investment in cyber skills, it also slows down business creation and increases exit rates.

A second approach is encouraging firms to integrate cybersecurity as part of their corporate social responsibility agenda. Anita McBain, Head of EMEA ESG Research at Citi Research, says “Investors have several reasons to engage with portfolio companies on their digital and cyber technology,” adding that “a breach could be financially, materially, and reputationally debilitating.”

The analysis also suggests that relying on private sector product vendors, with robust built-in AI/automation, that offer higher and more headcount-efficient defense, also enhances talent development and availability in the cyber space. Fatima Boolani, Co-Head of U.S. Software Research at Citi Research notes, “Our proprietary research has showcased that investment in security analytics operations toolsets remain optimistic and enjoys a relatively high priority sequence in the Chief Information Officer (CIO) organization.”

The invasion of Ukraine by Russia highlights the importance of cybersecurity in modern conflict. Cyberattacks can be used in tandem with military actions as coordinated war tactics and can be scaled up such that local conflicts can expose firms across the world to cybersecurity threats.

As the threat and costs of cyberattacks grow, firms seek to invest in cybersecurity personnel as part of their corporate risk management strategy. Between 2015 and 2021, the number of cyber jobs advertised by firms globally grew 4.3 times. At the same time, the number of information technology (IT) jobs advertised grew 3.5 times and the number of total jobs advertised grew 2.7 times.

However, rising demand for cyber skills is not being met with adequate supply of cyber professionals. For example, the average U.S. state has 2.6 cyber job postings per cyber professional. In addition, the average cyber professional has less experience than the average IT professional and only 11% of the cyber workforce has at least 20 years of experience.

About Citi

Citi is a preeminent banking partner for institutions with cross-border needs, a global leader in wealth management and a valued personal bank in its home market of the United States. Citi does business in more than 160 countries and jurisdictions, providing corporations, governments, investors, institutions and individuals with a broad range of financial products and services.

Additional information at: www.citigroup.com | Twitter @Citi | www.youtube.com/citi | http://blog.citigroup.com | www.facebook.com/citi | www.linkedin.com/company/citi.

About Citi Global Perspectives & Solutions

As our premier thought leadership product, Citi Global Perspectives & Solutions (Citi GPS) is designed to help our clients navigate the global economy's most demanding challenges, identify future themes and trends, and help our clients profit in a fast-changing and interconnected world. Citi GPS accesses the best elements of our global conversation and harvests the thought leadership of our research analysts and a wide range of senior professionals across our firm.

About The Oxford Martin School

The Oxford Martin School is a world-leading research department of the University of Oxford. Its 200 academics work across more than 30 pioneering research programmes to find solutions to the world's most urgent challenges. It supports novel and high-risk projects that often do not fit within conventional funding channels, with the belief that breaking boundaries and fostering innovative collaborations can dramatically improve the wellbeing of this and future generations. Underpinning all our research is the need to translate academic excellence into impact – from innovations in science, medicine and technology, through to providing expert advice and policy recommendations.

Web: www.oxfordmartin.ox.ac.uk - Twitter: @oxmartinschool - Facebook: /oxfordmartinschool

View source version on businesswire.com: https://www.businesswire.com/news/home/20230328005486/en/

Citi, EMEA, citiemeapressoffice@citi.com



Citi, USA, Stephanie Hyon stephanie.hyon@citi.com



Oxford Martin School, Kate O’Connor, kate.oconnor@oxfordmartin.ox.ac.uk

Source: Citi

FAQ

What is the main finding of Citi's cybersecurity report?

Citi's report reveals a severe mismatch between the demand for cybersecurity skills and their supply, driven by increasing cyber threats.

How much did cybersecurity job postings grow between 2015 and 2021?

Cyber job postings grew 4.3 times from 2015 to 2021.

What challenge does the cybersecurity industry face according to Citi?

The cybersecurity industry faces a significant skills gap, with only 2.6 job postings per cyber professional in the U.S.

What impact could government regulations have on cybersecurity investment?

Government regulations may encourage firms to invest more in cybersecurity skills, although they can also slow down business creation.

How does the report suggest firms address cybersecurity risks?

The report suggests integrating cybersecurity into corporate social responsibility agendas and relying on advanced AI/automation technologies.