How do you determine the number of Cyber Security persons an organization needs? What is the connection between the number of employees and the number of security systems?

Security Security Strategy & Roadmap Security & GRC

5.5k views13 Comments

Sort By:

Oldest

VP of IT in Educationa year ago

That’s a really tough question, I think the number of systems or log sources would be a better metric. If I had to pick a number I would probably say 1 for every 250 employees. But that also assumes you are using an EDR or XDR service to assist and probably outsource penetration testing, vulnerable management, and security/systems audits. If you’re developing external applications then I would at least double the number of security personnel.

VP of IT in Softwarea year ago

I have not really thought of this in terms of Cyber Security people to employees. I think of it in terms of security personnel to the number of applications that need to support and the complexity for these applications.

Director of Network Transformationa year ago

I think it "depends"... What vertical are you in? Are you subject to SOX, PCI, the new SEC rules and so on.. Are you regulated? Do you have a significant number of 3rd party requirements. This is a difficult question to answer.

Please join or sign in to view more content.

By joining the Peer Community, you'll get:

Peer Discussions and Polls
One-Minute Insights
Connect with like-minded individuals

C-PIO in Softwarea year ago

I don’t think you can really pin a number on it. Factors you have to consider our age of system, Legacy system, systems, number of users, both internal and X ternal’s. You have to do an assessment as to what you need and I know you’re looking for a number here but I find it’s far too difficult to give a hard number. The skill set of those security specialists is critical to solving your problem. An individual with the prescribed knowledge can handle a large volume of work, we’re as a poorly equipped or junior security specialist will struggle. This is also scale able in that you may need to throw more resources at the issue up front and then taper back once under control. Start with contractors and then migrate to in house is the best I can suggest.

Senior Director of Engineering in Softwarea year ago

I don't see an obvious correlation between them.

I think it depends on the size of your engineering team and the roadmap that you might have (e.g. DevX, SOC2).

I would start with a lower number, say 3, understand the capacity and then fine tune it to one's needs.