While money is usually no object and tech tools are abundant for insurers struggling to contain cybersecurity threats, talent is often in short supply, undermining the industry’s ability to secure existing and developing systems.

That was one of the chief takeaways from recent interviews conducted by the Deloitte Center for Financial Services with chief information security officers (CISOs) or their equivalent at leading insurers, as well as banks and investment companies, who often cited a deficiency in people power as their biggest challenge.

Technical skills, business know-how, strategic thinking capabilities

In particular, many complained about an acute shortage of “triple threats” — those with the technical skills, business know-how, and strategic thinking capabilities to implement cyber risk management initiatives quickly and effectively, without unreasonably inhibiting business development or undermining customer experience. One CISO noted, with a hint of despair, that people with these kinds of qualifications don’t grow on trees.

Most of our interviewees were vehement that if you don’t have the right personnel with the necessary skill sets at your disposal to formulate and execute strategies for security, vigilance, and resilience, it won’t matter what solutions a company buys or builds because cyber risk management projects won’t get the level of execution they need to stay ahead of increasingly sophisticated and ever-evolving threats.

Global op challenges

Talent acquisition and retention is a particular challenge for those with global operations. One CISO whose company has an international presence — citing the need to constantly monitor and comply with an ever-changing regulatory environment around the world — recruits dedicated cyber resources on a geographic basis, particularly when expanding into a new country. This CISO noted it is unrealistic to expect to establish a “one-stop shop” to account for global cyber risk challenges based in the United States alone.