Cross-Training IT Staff in Cybersecurity: Outcomes and Optimal Program Design

What Did This Cybersecurity Research Find?

This cybersecurity cross-training study evaluated outcomes from 40 organizations that trained existing IT staff to take on security responsibilities. Cybersecurity cross-training programs that ran for 120+ hours with hands-on lab components produced IT staff who scored within 15% of dedicated security hires on technical assessments, offering a cost-effective approach to expanding security capacity.

Key Findings

• 1Cross-trained IT staff scored within 15% of dedicated security hires on technical assessments
• 2Programs of 120+ hours with labs produced the best outcomes; shorter programs showed minimal transfer
• 3Cross-trained staff retained their IT responsibilities 73% of the time, creating dual-role tension
• 4Organizations that created dedicated security time (minimum 50% of role) saw the best outcomes
• 5Cross-trained staff who later transitioned to full-time security roles had 26% lower turnover

How Does This Apply to Cybersecurity Careers?

IT professionals can use cross-training as a stepping stone to dedicated security roles. Organizations facing hiring challenges can build security capacity from existing staff.

Who Should Read This?

Frequently Asked Questions