Despite headlines now at least a couple of years old, the InfoSec world is still (largely) playing lip-service to the lack of security talent and the growing skills gap.

The community is apt to quote and brandish the dire figures, but unless you’re actually a hiring manager striving to fill low to mid-level security positions, you’re not feeling the pain—in fact, there’s a high probability many see problem as a net positive in terms of their own employment potential and compensation.

I see today’s Artificial Intelligence (AI) and the AI-based technologies that’ll be commercialized over the next 2-3 years as exacerbating the problem—but also offering up a silver-lining.

I’ve been vocal for decades that much of the professional security industry is and should be methodology based. And, by being methodology based, be reliably repeatable; whether that be bug hunting, vulnerability assessment, threat hunting, or even incident response. If a reliable methodology exists, and the results can be consistently verified correct, then the process can be reliably automated. Nowadays, that automation lies firmly in the realm of AI—and the capabilities of these newly emerged AI security platforms are already reliably out-performing tier-one (e.g. 0-2 years experience) security professionals.

In some security professions (such as auditing & compliance, penetration testing, and threat hunting) AI-based systems are already capable of performing at tier-two (i.e. 2-8 years experience) levels for 80%+ of the daily tasks.

On one hand, these AI systems alleviate much of the problem related to shortage and global availability of security skills at the lower end of the security professional ladder. So perhaps the much touted and repeated shortage numbers don’t matter—and extrapolation of current shortages in future open positions is overestimated.

However, if AI solutions consume the security roles and daily tasks equivalency of 8-year industry veterans, have we also created an insurmountable chasm for recent graduates and those who wish to transition and join the InfoSec professional ladder?

While AI is advancing the boundaries of defense and, frankly, an organizations ability to detect and mitigate threats has never been better (and will be even better tomorrow), there are still large swathes of the security landscape that AI has yet to solve. In fact, many of these new swathes have only opened up to security professionals because AI has made them available.

What I see in our AI Security future is more of a symbiotic relationship.

AI’s will continue to speed up the discovery and mitigation of threats and get better and more accurate along the way. It is inevitable that tier-two security roles will succumb and eventually be replaced by AI. What will also happen is that security professional roles will change from the application of tools and techniques into business risk advisers and supervisors. Understanding the business, communicating with colleagues in other operational facets, and prioritizing risk response, are the intangibles that AI systems will struggle with.

In a symbiotic relationship, security professionals will guide and communicate these operations in terms of business needs and risk. Just as Internet search engines have replaced the voluminous Encyclopedia Britannica and Encarta, and the Dewey Decimal system, Security AI is evolving to answer any question a business may raise about defending their organization—assuming you ask the right question, and know how to interpret the answer.

With regards to the skills shortage of today—I truly believe that AI will be the vehicle to close that gap. But I also think we’re in for a paradigm change in who we’ll be welcoming into our organizations and employing in the future because of it.

I think that the primary beneficiaries of these next-generation AI-powered security professional roles will not be recent graduates. With a new level playing field, I anticipate that more weathered and “life experienced” people will assume more of these roles.

For example, given the choice between a 19-year-old freshly minted graduate in computer science, versus a 47-year-old woman with 25 years of applied mechanical engineering experience in the “rust belt” of the US,... those life skills will inevitably be more applicable to making risk calls and communicating them to the business.

In some ways, the silver lining may be the middle-America that has suffered and languished as technology has moved on from coal mining and phone-book printing. It’s quite probable that it will become the hot-spot for newly minted security professionals—leveraging their past (non-security) professional experiences, along with decades of people or business management and communication skills—and closing the missing security skills gap using AI.