Over the last year, the cybersecurity industry has faced a flurry of challenges, including unsteady budgets, a talent shortage and concerns over artificial intelligence development. Still, there are signs of strength: Gartner finds that information security spending is projected to total $212 billion in 2025, a 15 percent increase from 2024.
The rise in security spending is a reaction to issues ranging from investment and concerns about A.I. and generative A.I. technologies and platforms, the continuing shift toward cloud computing, and the need to hire talented tech and cybersecurity pros to fill needed roles.
As the calendar hurdles toward 2025, Dice spoke to several experts across the cybersecurity landscape to better understand how the industry is poised to change over the ensuing 12 months. These trends can also help tech and security professionals measure their career opportunities, including the skill sets they need following a tough job market in 2024 that saw layoffs and hiring slowdowns across multiple sectors.
Several insiders noted that the coming months are when cybersecurity professionals must master the business side even more, as the nature of the security shifts and organizations weigh risks, compliance and governance that affect the bottom line, experts noted.
“The cybersecurity field will increasingly demand professionals who combine technical expertise with a strong understanding of business objectives. As the threat landscape grows more complex, organizations will prioritize candidates with a hybrid skill set—deep cybersecurity knowledge paired with expertise in risk management and regulatory compliance,” said Danny Brickman, CEO and co-founder at Oasis Security. “This shift will be driven by the need for cybersecurity to be seamlessly integrated into broader enterprise strategies, shifting away from a siloed approach to one that aligns directly with overall business goals.”
Here is a look at five significant cybersecurity trends for 2025, and what these developments mean for the tech and security pros community.
Hiring Challenges Will Remains and Skills Continue to Matter
By the end of 2024, CyberSeek estimated that 1.25 million tech pros work in cybersecurity throughout the U.S., but an additional 457,000 cyber positions remain open in the public and private sectors.
While the industry has pointed to the talent gap for years, some experts see organizations adopting more automation technologies—whether A.I. or other platforms—to fill these gaps, especially around more mundane tasks. This trend can benefit cybersecurity pros who want to develop deep skills through upskilling and tackle more complex cyber issues.
“To offset a lack of skilled professionals, more organizations are pursuing strategies for automation. In this way, if one person on a five-person IT team leaves a company, the remaining four-person team can continue by plugging the gap with automation,” said Douglas Murray, CEO at Auvik Networks. “Similarly, the team has more time to spend upskilling and earning new and highly relevant certifications and training than they did before because automation is helping to offset the monotonous, time-intensive tasks.”
While automation remains a significant issue, Murray also sees organizations (especially mid-tier firms) needing security professionals who understand Amazon Web Services, Microsoft Azure and other cloud infrastructure platforms as more data and applications move off-premises.
For others, tech and security pros need to brush up on identity skills for the new year, especially as major tech platforms such as Microsoft and Google (Meta may also follow) roll out additional multifactor authentication (MFA) requirements for their clients.
“Between consumer-facing platforms requiring MFA and banks reducing SMS MFA due to SIM-swapping and other breaches that exploit telecom infrastructure, security personnel will need to learn how to evaluate, deploy, and manage MFA, and to protect the gaps that MFA doesn’t directly address, such as onboarding, recovery of authenticators, help desk-related identity procedures and other business processes,” said Rob Hughes, CISO of RSA.
While skill sets matter, other organizations can help close the talent gap by hiring more women for cybersecurity roles. At the same time, this requires reducing salary inequality within the industry, said Teresa Rothaar, governance, risk and compliance analyst at Keeper Security.
“Organizations should tackle pay disparities to ensure equal compensation for women serving in the same or similar roles as their male counterparts. This can be accomplished by conducting regular pay audits and promoting transparency in salary structures,” Rothaar added. “Additionally, creating more pathways for women to advance into leadership roles through mentorship programs, sponsorship and leadership development initiatives can be beneficial. Offering flexible work arrangements, childcare support and robust parental leave policies can also help retain female talent.”
AI Issues Continue to Raise Concerns
Few conversations over the last two years have been complete without mentioning generative A.I. In cybersecurity, these platforms are seen as a solution to some problems, and the cause of others—especially as cybercriminals adopt the technology as their own.
In the Gartner report, generative A.I. will likely cause a “spike” in the cybersecurity resources required to secure it, leading to a 15 percent increase in security software spending in 2025.
In the next year, organizations of all sizes will attempt to determine where generative A.I. and A.I. fit into their security organization. Firms are also seeking out tech talent that knows how to utilize these platforms, said Stephen Kowski, field CTO at SlashNext.
“A.I. excels at processing massive volumes of security telemetry and identifying subtle attack patterns, effectively acting as a force multiplier for security teams while reducing alert fatigue and analyst burnout,” Kowski said. “The most impactful applications of A.I. in security operations include automated phishing detection, real-time analysis of user behavior, and intelligent correlation of security events across multiple channels – tasks that would typically require numerous analysts working around the clock.”
Changing Role of the CISO
While hiring tech and security pros to help fill out a cybersecurity organization is viewed as a top priority, many organizations are also rethinking or reimaging the role of the CISO. At the same time, security leaders are cognizant of the new responsibilities these positions now entail.
Studies show that CISOs are now responsible for more than securing i,frastructure and data. These new duties include policy development, risk management and responding to government regulatory oversight. In a few cases, security leaders are held legally responsible following an incident or breach.
The upside is that added responsibilities mean more compensation for overworked CISOs.
“With liability risks on the rise, organizations will make bold moves to attract top security talent. In response, organizations will implement stronger protections, including indemnification clauses and enhanced Director and Officer insurance, to shield CISOs from undue personal risk,” said George Jones, CISO at Critical Start. “To further distribute accountability, companies will expand leadership structures by introducing roles like Chief Risk Officers and Data Protection Officers, ensuring clear role delineation. These measures will not only attract top cybersecurity talent but also create a more secure professional environment, enabling CISOs to prioritize risk resilience and regulatory compliance without fear of excessive personal exposure.”
These developments also point to an ongoing transformation of moving away from a tools-based cybersecurity approach to a risk-based one, said RSA’s Hughes.
“The security role and related CISO leadership is transitioning even more from a tools-based security approach to an overall culture and risk-driven approach, where the ability to build confidence, develop alliances, have hard conversations and negotiate an imperfect risk-based solution with the help of IT teams and systems owners will be key to success,” Hughes added.
Fresh Approaches to Cyber Defenses
Over the past year, with attacks targeting hospitals, healthcare systems, pharmaceuticals, energy and transportation systems, organizations are turning toward a breach-ready defenses approach. These techniques allow organizations to continue day-to-day operations while giving security teams time to isolate an incident and repel the threat.
Tech pros should watch as this shift continues into 2025, said Agnidipta Sarkar, vice president for CISO advisory at ColorTokens.
“What we have not seen is a large-scale realization that almost all weaknesses in IT service management are the main reason why breaches happen and that investment in digital resilience must be done to facilitate the ability to operate business-as-usual in most of the organization, compared to shutting down operations,” Sarkar said. “Each cyberattack we witnessed is an indicator for businesses to understand that an investment is needed in capabilities that require an integrated approach.”
Don’t Ignore OT Security
While much attention is paid to breaches and attacks that target IT systems, operational technology (OT) security is often overlooked, despite the focus on threats to critical infrastructure such as nuclear plants, water treatment facilities and other industries that rely on these legacy technology systems.
The recently published Orange Cyberdefense Security Navigator 2025 report found that the U.S. is the epicenter of OT-targeted attacks, responsible for about 49 percent of all global incidents, with half aiming to seize control of industrial equipment.
This trend signifies a dangerous escalation beyond data breaches and ransomware, posing direct threats to critical infrastructure and physical safety. The increasing sophistication and frequency of these attacks, coupled with the ongoing convergence of IT and OT networks, will create a surge in demand for specialized OT security expertise across manufacturing, energy and healthcare, said Bill Nazario, a senior security expert on IT/OT at Orange Cyberdefense.
“Professionals with skills in industrial control systems [ICS], supervisory control and data acquisition [SCADA] systems and OT-specific security protocols will be in high demand,” Nazario added. “In addition, a deep understanding of regulatory compliance frameworks relevant to critical infrastructure will be essential. Professionals who invest in acquiring these in-demand OT security skills will be well-positioned for lucrative career opportunities in a rapidly evolving cybersecurity landscape.”
Comments
Post a Comment