How to Manage Enterprise Security Staffing Levels

If you ask an analyst or consultant what the proper headcount staffing level should be for cybersecurity team members in a corporation, you will likely get a recommendation along the lines of 5% of IT staff. Gartner, for example, has cited 5.6% as an average, but this is a misleading and inappropriate measure in most cases. It is an example of just repeating some made-up number over-and-over enough to make it eventually just become part of the lexicon.

Our view at TAG Cyber is that many local factors determine the proper level of headcount in a CISO-led team. Our view is that asking for a general guide for security headcount is like asking for a general guide for proper size of marketing, middle-management, or sales team headcount. None of these are well-formed questions. Rather, leadership teams must make informed judgement based on the specifics of the local environment.

In the estimation of the TAG Cyber team, we believe that an organization should consider the following factors in estimating the size of their IT and information security staffing levels. These factors can be used to justify budget and spend in the context of short-term and long-term planning. The implication here is that we do not believe that a simple percentage of security staff can ever be properly stated based on employee base or IT security budget.

Staffing Level Factor 1: Functions

A typical enterprise security team covers IAM, SOC, Architecture, Cloud/SaaS Security, eDiscovery, DFIR, GRC, AppSec, DevSecOps, Data Security, Privacy, Awareness, VM, and TPRM. If the team supports additional functions, such as Customer Facing Security (as in cyber insurance, for example), then this can inflate staffing numbers, especially if these are revenue generating positions. A major staffing factor is thus the degree to which the CISO-led team is being asked to extend into adjacent areas.

Staffing Level Factor 2: Organizational Structure

The typical security team starts with a CISO and perhaps a Deputy CISO managing a group of direct reports. The structure of the organization will have impact on the number of staff required. In general, organizations with flatter structures and fewer management levels will require fewer staff. Similarly, when the local culture dictates a more hierarchical approach, then a larger number of interim managers and supervisors will be present, thus inflating aggregate staffing requirements.

Staffing Level Factor 3: Outsourcing

Obviously, if an MSSP covers functions such as SOC operations, then this will reduce staffing levels. Company A, for example, might cover a SOC function with 16 internal staff, whereas Company B might cover this same SOC function with an outsourced deal and 0 staff. This implies that staffing levels cannot be determined by a simple equation or percentage, especially in cases where an MSSP has been engaged to provide support.

Staffing Level Factor 4: Operations

Internal functions such as IAM administration can be done within the security team or provided by some adjacent group such as IT Operations. These choices obviously affect and influence security staffing levels. Information security teams that do their own operations will have considerably higher staffing levels than information security teams that rely on IT operations or adjacent internal support to perform these day-to-day, often 24/7 functions.

Staffing Level Factor 5: Threat

The level of threat a company experiences will dictate the levels of staffing for the security team. It stands to reason, for example, that a team of consultants planning children's parties will have a lower threat than a team that manages nuclear disposal. It is reasonable that staffing levels be connected to threat levels. Executives should understand this factor and recognize that a one-size-fits-all metric applies poorly to threat, and hence applies poorly to staffing levels.

Staffing Level Factor 6: Experience

The experience of the security team (and the company) in the management and administration of cybersecurity will also influence security staffing levels. One highly experienced person can cover the same amount of work as, say, three brand-new employees who are just learning the field. It is therefore inappropriate to count staff headcount uniformly. One experienced person will always equal multiple inexperienced staff – and this simply cannot be avoided.

Staffing Level Factor 7: Automation

Every security team is now influenced by automation, especially AI. In fact, automating a repeatable security task should improve its operation (if done properly) and should also reduce headcount needs. One problem is that if security teams are trying to increase their headcount, perhaps to drive higher budgets or to create more responsibility (for career advancement), then they will want to avoid too much automation.

Staffing Level Factor 8: Budgeting

If a company is struggling, then all functions including security will be expected to be reduced. If budgets are healthy, then all functions including security will probably be allowed to keep or increase their budget. A key issue here is whether budget and headcount are decoupled in the planning process. The best situation involves allowing the CISO to manage to a budget, versus a headcount number. This allows the flexibility to automate, outsource, and reallocated saved funds.

Proposed Methodology for Establishing Headcount

The only reasonable methodology for justifying staffing levels is to work through each of the factors listed above and to develop clarity in the structure, operation, and coverage for each function. Here are some simple steps to include in the process:

Step 1: Document and Justify Your Budget and Staff

Develop and clearly document the roles, operations, and support for what is in place today. Explain how the functions interoperate that you support. Include detailed descriptions for all functions and how they are staffed. This is your staffing baseline, and it will heavily influence your future staffing levels.

Step 2: Explain the Eight Factors Listed Above

Go through each of the factors listed above and explain how each applies in the local context. Use examples to illustrate threat and other factors. Include details in your analysis. This is how you move the needle on gaining additional staffing from your current baseline.

Step 3: Propose a Staffing Level as a Function of Current Levels

Based on the local situation (such as health of the organization from a sales and revenue perspective), propose increases, maintenance, or reductions based on local conditions. Be sure to be reasonable and honest here. If you don't need additional staff, then do not ask for more. That sounds obvious, but it is sadly not the norm.

Good luck with your enterprise security budgeting for 2024, and our team at TAG Cyber is always available to help. We look forward to hearing from you!