For 55% of South African cybersecurity teams, staffing is already a problem. ISACA’s 2025 State of Cybersecurity report found that 65% of organisations have unfilled cybersecurity positions, while 70% expect demand for technical cybersecurity professionals to increase over the following year.
These figures expose a vulnerability that can easily be overlooked when organisations focus solely on strengthening their cyber defences. Security technology may identify a threat, flag unusual behaviour, or prevent an attack, but high calibre people are needed to interpret the signals, investigate what is happening, and take the next steps.
As cybersecurity becomes more sophisticated, security is no longer confined to protecting a corporate network. Organisations need capability across areas such as cloud security, identity and access management, security operations, threat intelligence, incident response, security engineering, and governance.
This makes the traditional approach to cybersecurity recruitment increasingly difficult. Organisations cannot always wait for candidates who already have every technical skill required for a role, particularly when these skills are in high demand and the technology itself continues to evolve. However, when employers prioritise experienced professionals who understand legacy systems and can adapt to new technologies, this approach risks overlooking younger candidates with strong learning agility who can be upskilled to meet changing requirements.
There is also a generational challenge. Younger cybersecurity professionals are entering a field with rapidly expanding career opportunities, but they are often looking for more than a job title. Exposure to emerging technologies, opportunities to develop specialist expertise, and visible career progression can influence where they choose to build their careers.
For employers, this means talent strategy needs to extend beyond filling an immediate vacancy. A cybersecurity team needs a sustainable pipeline of skills, supported by opportunities for existing employees to develop and for emerging professionals to gain practical experience.
Training and certification come into play here. Technical qualifications can provide a foundation, but practical exposure is equally valuable in a field where the ability to apply knowledge in a live environment is as important as knowing the theory. Learnerships, internships, and structured development programmes help bridge this gap while giving organisations access to talent with the potential to develop into future specialists.
This is where specialist IT recruitment has an increasingly important role. A recruiter with a detailed understanding of the technology market can help organisations assess which skills are genuinely scarce, where transferable capabilities may exist, and whether a role needs a fully-formed specialist or someone with the foundation to develop into one.
Within Adcorp, Torque IT complements this approach through technical training and certification, thus creating a pipeline of IT professionals with skills that align with changing market requirements.
Cybersecurity focus areas and budgets often target the protection of data, systems, and customers. And rightly so. But, a security platform can only be as resilient as the capability behind it, and this capability must be built before a breach happens, not after. And, it deserves the same level of strategic attention as the security itself.
