Cybersecurity's Hidden Gap: Skills, Not Just Firewalls

Shauna Briley has been named in an Influential Women feature highlighting her dual focus on protecting critical infrastructure systems and expanding access to cybersecurity careers for people who have historically been shut out of the field. The recognition arrives as organisations worldwide report persistent difficulty filling security roles even as attacks on power grids, water systems, hospitals and transportation networks grow more frequent and more disruptive.

The Workforce Problem Behind Every Breach Headline

Cybersecurity has spent the better part of a decade warning about a shortage of qualified professionals, and the warning has not gone away. Every major breach involving critical infrastructure tends to prompt the same two-part reaction: better technology is needed, and so are more people capable of operating it.

What makes Briley's profile notable is its framing of workforce access as a security issue in its own right, not merely a hiring inconvenience. Systems that run power plants, water treatment facilities and transit networks increasingly rely on operational technology connected to corporate networks, a convergence that has expanded the attack surface faster than many organisations can staff for it.

Agencies such as the Cybersecurity and Infrastructure Security Agency have repeatedly flagged critical infrastructure as a priority target for both criminal and state-linked actors, underscoring why the people defending these systems matter as much as the tools they use.

The sector's talent shortfall is not new, but it has proven resistant to conventional fixes. University pipelines alone have not kept pace with demand, prompting a broader rethink of who counts as a viable candidate for security roles.

Widening the Door Instead of Guarding It

Briley's work on opening cybersecurity careers to those in need points to a shift already underway across the industry: treating nontraditional candidates, including career changers, veterans and people from underserved communities, as an underused talent source rather than a compromise.

This approach mirrors workforce frameworks promoted by bodies such as the National Initiative for Cybersecurity Education, which emphasises skills and competencies over formal credentials when mapping entry routes into the field. Certification programmes, apprenticeships and employer-sponsored training have become more common as organisations try to build their own pipelines rather than compete for a limited pool of experienced specialists.

For employers, the calculation is increasingly practical rather than charitable. A broader applicant pool helps address immediate staffing gaps while also bringing in people whose life experience, including work in other regulated or high-stakes industries, can translate into strong judgment under pressure.

Whether this shift meaningfully narrows the shortage will depend on how many organisations move beyond pilot programmes and into sustained hiring practices, something the industry has promised before without fully delivering.

Why Critical Systems Security Is Becoming Harder, Not Easier

The systems Briley's work focuses on, those underpinning energy, water and transport, were largely designed decades before cybersecurity was a design consideration. Retrofitting security onto infrastructure never built for connectivity is slower and costlier than securing modern cloud-native systems, and it requires specialists fluent in both information technology and the operational technology that runs physical equipment.

That dual expertise is scarce, which is part of why workforce development and infrastructure protection are increasingly discussed together rather than as separate problems. The same industrial convergence driving demand for OT-literate security staff is also reshaping how automation and AI tools are deployed on factory floors, a trend examined in a recent look at how AI agents are moving from the boardroom to the factory floor, adding another layer of systems that will eventually need securing.

Geopolitical tension has only sharpened the stakes. Governments in multiple regions have issued advisories in recent years urging infrastructure operators to assume they are active targets rather than hypothetical ones, a posture that assumes adequate staffing exists to act on the warnings.

Profiles like Briley's serve a dual purpose in this environment: they recognise individual contribution while implicitly making the case that the industry's staffing problem and its infrastructure risk are two sides of the same issue.

Briley's recognition in the Influential Women feature underscores a trend that is likely to continue shaping cybersecurity hiring and infrastructure policy alike. As attacks on essential systems grow more sophisticated, the sector's ability to defend them will hinge as much on who is recruited and trained as on what technology is deployed, making workforce access an increasingly central, rather than peripheral, part of the security conversation.