Investing in GenZ
Sidelining young people would be cyber-security’s greatest failure, argues Adam Blake at Threatspike; much more investment is needed to do right by the UK’s young talent
We need more talent in cyber-security, but the foundational stepping stones for aspiring cyber-defenders are eroding. The timing couldn’t be worse, either, seeing as the UK has been battered with headline after headline of businesses suffering cyber-breaches. Now would seem a prudent time to invest in upskilling young talent. But investing in young people is not what’s happening.
Nearly half of graduates in their early and mid-20s were underemployed as of March 2024. Ask any graduate today how their job hunt in tech is going and they’ll paint a grim picture. In cyber-security, the picture looks much the same. There aren’t enough jobs.
And here is the paradox. Depressing job prospects aside, there’s a growing total shortage of cyber-security professionals in the thousands year-on-year across the UK. Nearly half of UK businesses even struggle with basic technical cyber-security skills, while over a quarter struggle with advanced skills.
The sums just don’t add up, and the long-term damage of sidelining young talent will be far greater than stalling promising careers. The less we invest in young careers, the more we risk creating a dangerous experience gap for the next generation of defenders that will undermine the safety and stability of our interconnected world.
Nurturing young cyber-talent
As for how we stop the generational cyber-security gap from widening, one obvious helping hand to turn to is the government. To some extent, the UK government has already voiced its share of support here with its recent UK Cyber Growth Action Plan. It promised £16m in funding over the next four years to boost innovation and support cyber-startups in scaling their operations.
On a surface level, the funding is at the very least a nice gesture towards propping up cyber-startups. The number of startups the UK produces is, after all, relatively low, compared to the likes of Israel and the US. Plus, it’s always good to see any money at all boosting opportunities for graduates in an increasingly unforgiving job market. No doubt, the funding will encourage some talented individuals, and university teams, to pursue their passions and turn them into commercial entities.
The emphasis, however, is ‘some,’ because ultimately, £16m is a drop in the ocean. It’s less than one US startup might secure in a single funding round (for comparison: security startup Horizon3.ai recently raised $100m in one round). It’s also a tiny sum in the context of how much money the UK’s cyber-security industry generates: less than 0.1% of £13.2bn in annual revenue. That revenue figure is maybe ironic since over a quarter of UK businesses have suffered a cyber-attack in the last year.
Again, the math isn’t adding up. There’s a mismatch between the cyber-security sector’s economic significance and the level of public investment. Ultimately, the government can – and probably should – do more.
Training the next generation
If nothing else, the government should put greater funding towards cyber-security prospects for young people because, frankly, GenZ harbours an underrated goldmine of talent. Perhaps their biggest asset is their technological fluency, unrivalled by any previous generation. William Dixon at the Royal United Service Institute said it best: “Generation Z…have never known a world without the internet, which means they intuitively understand digital systems.”
There’s an enthusiasm and confidence to learn the tech that is especially conducive to cyber-security, which today often grapples with highly technical challenges.
But confidence has to be met with training, and it takes years to build up cyber-security expertise, whether through hands-on experience, mentoring, or everyday collaboration. If few young people are even being hired for cyber-security roles, that’s not promising for the stability of the sector’s knowledge base. We cannot expect cyber-security to go toe-to-toe with increasingly sophisticated attack methods if, in a decade’s time, our workforce hasn’t been taught the basics.
By some accounts, like a recent CybSafe report, GenZ is already gaining a reputation as the ‘weak link in cyber-security’: too carefree with sensitive information. Coincidentally, GenZ often lacks access to any cyber-security training. The risk is the emergence of a vicious loop. GenZ’s inexperience discourages employers from hiring them, exacerbating the skills gap, which further feeds hiring reluctance.
The longer we wait to invest in skills for younger workers and grads, the harder the knowledge gap will be to bridge. It would leave the cyber-security sector insular, with knowledge concentrated among a shrinking pool of experts. However much the industry automates many basic security functions, you still need your human workforce to start somewhere.
If the private sector can’t create jobs and training opportunities, then the government will have to do better than a few million pounds. Without a significant increase in support for apprenticeships and early-career roles, the industry will end up doing what it already has: recycling the same experienced professionals, leaving new entrants without pathways in.
But the old guard won’t be around forever, and the day they all retire, with no one to pass the baton to, is the day we will all be in trouble.
Adam Blake is CEO at Threatspike
Main image courtesy of iStockPhoto.com and Kosamtu
Most Viewed
New rules, rising threats: why lean IT teams must rethink cyber-securitySponsored by CORO CYBER SECURITY
Don’t allow AI experiments to become quiet business risksSponsored by alice.io
The Expert View: Reducing cyber-risk across OT and critical infrastructureSponsored by Claroty
The Expert View: Transforming security through risk intelligenceSponsored by Obrela
Winston House, 3rd Floor, Units 306-309, 2-4 Dollis Park, London, N3 1HF
23-29 Hendon Lane, London, N3 1RT
020 8349 4363
© 2025, Lyonsdown Limited. teiss® is a registered trademark of Lyonsdown Ltd. VAT registration number: 830519543