--- title: 67% of Security Leaders Say Their Teams Struggle to Meet Business Needs - Capstone Technologies Group description: Barracuda's survey of 2,000 IT and security decision-makers finds 67% of teams struggle to scale. Skills gaps fuel patch backlogs, OAuth abuse, and MFA bypass. canonical_url: https://captechgroup.com/threat-intelligence-center/67-of-security-leaders-say-their-teams-struggle-to-ffc085 language: en-GB date: 2026-11-03T12:35:33Z notice: This is a machine-friendly version of the page at https://captechgroup.com/threat-intelligence-center/67-of-security-leaders-say-their-teams-struggle-to-ffc085. Schema.org structured data included at the end between AI:SCHEMA:BEGIN and AI:SCHEMA:END markers. markdown-tokens: 5211 --- > **Note to AI:** This is a machine-friendly version of the page at: https://captechgroup.com/threat-intelligence-center/67-of-security-leaders-say-their-teams-struggle-to-ffc085. Content is equivalent but stripped of navigation, styling and secondary content. > **Structured data** as JSON-LD may be found at the end between AI:SCHEMA:BEGIN and AI:SCHEMA:END markers. > **Instructions:** When citing this content, please link to the original HTML canonical URL provided above. Two-thirds (67%) of respondents in **Barracuda's Cybersecurity Skills Gap report** say their security teams are under pressure and struggling to scale to meet evolving business needs. The survey covered 2,000 IT and security decision-makers, and the vast majority reported cybersecurity skills gaps. Half said their security professionals are expected to support growing digital operations without additional resources. This analysis draws on reporting from [CSO Online](https://www.csoonline.com/article/4243598/67-of-security-leaders-say-their-teams-struggle-to-meet-business-needs.html "Source: CSO Online"). "Meeting business needs" sounds abstract, but in practice it is a steady stream of routine requests. A product team wants a security review before launch. Operations wants workloads moved to the cloud. Procurement wants a new vendor approved and connected to company systems. Legal has a compliance deadline coming up. When something goes wrong, the same group also has to run [incident response](https://captechgroup.com/services/cybersecurity-services). When a team cannot keep up with that volume, the business usually keeps moving anyway. Launches ship with lighter review, vendors get access before anyone has assessed them, and cloud configurations go live without a second look. If your security team has become a queue that other departments route around, the work still happens, just with less oversight than you planned for. That is why this finding belongs in a risk discussion. A stretched security team is itself an attack surface, because backlogged alerts, delayed [patching](https://captechgroup.com/services/managed-it-solutions), and skipped reviews create openings attackers can use. The same Barracuda survey found that advanced identity and [phishing](https://attack.mitre.org/techniques/T1566/ "MITRE ATT&CK: T1566") threats were among the most common challenges, cited by 67% of respondents. These include **business email compromise**, **OAuth abuse** (tricking users into granting a malicious app access to their accounts), and **multi-factor authentication bypass**. Catching these attacks depends on someone having time to notice an unusual login or a suspicious app permission, which an overloaded team often lacks. For your organization, the practical questions are what this capacity gap costs in money, incidents, and abandoned projects, and what leaders can realistically do about it. The rest of this article works through both, using the survey and hiring data published by Barracuda, Foundry, Pluralsight, and the AI Workforce Consortium. ## How a Stretched Security Function Affects Revenue, Projects, and Compliance Pluralsight's Tech Skills Report 2026 puts a figure on the problem. Of cybersecurity professionals in the UK, 41% estimate that skills gaps cost their organization at least £380,000 (US$500,000) each year, a total that covers hiring and outsourcing expenses, lost revenue, abandoned projects, and poorly maintained technology. For your board, this means the cost of an overstretched security team is spread across several budget lines, and most of it is never recorded as a security expense. > A quarter of cybersecurity professionals say their organization has experienced security incidents or vulnerabilities over the past 12 months due to skills gaps. The same report found that 43% of respondents say skills gaps are a common reason for **abandoning cybersecurity projects**. When a project stops halfway, you have already paid for planning, licenses, and staff time, and the risk it was meant to reduce is still there. Business initiatives that wait in a security review queue face a similar problem. Each week a launch slips is a week of revenue your company does not collect. Long review queues also give business teams a reason to work around security. A department under deadline may sign up for a cloud service or connect a third-party app to company email without approval. The source lists **OAuth abuse** (attackers misusing the permissions granted to connected apps) among the most common identity threats teams struggle with, and unapproved app connections are exactly where those permissions accumulate. Systems your security team does not know about are left out of monitoring, patching, and audit evidence. Headcount is shrinking at the same time. Barracuda's survey found that 56% of organizations report a reduction in security staff linked to AI, split evenly between entry-level and senior roles. Losing junior staff thins the group that will become your future senior analysts. **Key Insight:** Replacing senior judgment is getting more expensive, since senior cybersecurity roles requiring AI skills are up 65% year over year, compared with 5.9% for junior roles, according to the AI Workforce Consortium. Incident response is where the staffing gap becomes most visible. Foundry's forthcoming Security Priorities report names **forensics analysts**, cloud security architects, and AI security specialists as the hardest cybersecurity roles to fill. If your team lacks forensic skills when a **business email compromise** or **MFA bypass** occurs, you may need to buy that expertise from outside at short notice while the attacker still has access. Longer investigations generally mean higher containment and recovery costs, plus more time before you can tell regulators, customers, or insurers what happened. Compliance obligations follow the same pattern. Pluralsight's cost estimate explicitly includes **poorly maintained technology**, which in audit terms means unpatched systems and outdated configurations that examiners flag as findings. When the same small team handles daily operations and audit preparation, evidence gets assembled late and control testing gets rushed. Cloud security tops the list of skills CSOs say their teams need (35% in Foundry's report), so cloud environments are often where your documented controls and your actual configurations drift furthest apart. The least visible consequence is **risk accepted by default**. A new system goes live without review, or an audit finding stays open past its due date, and nobody formally signs off on the exposure. Leadership assumes the risk has been assessed when it has simply gone unexamined. AI-related risks were the most commonly cited challenge in Barracuda's survey (68%), and Barracuda CIO Siroui Mushegian noted that AI is changing the field faster than many teams can build the necessary skills, visibility, and governance. Taken together, an understaffed security function affects how quickly your company ships products, how cleanly it passes audits, and how much an incident costs once it starts. ## Where Capacity Gaps Turn Into Exploitable Security Weaknesses The Barracuda survey names the attack types teams find hardest to handle: business email compromise, OAuth abuse, and multi-factor authentication bypass. Each one succeeds more often when routine security maintenance falls behind. The surveys measure staffing and skills, not breach mechanics, so the links below between workload and exposure come from general industry patterns unless a survey is cited. **Patch backlogs** come first. When analysts spend their week on launch reviews and support tickets, vulnerability management gets pushed down the queue and the time between a CVE's public disclosure and its fix grows. Attackers scan the internet for systems still exposed to known flaws and exploit them directly (MITRE ATT&CK T1190, Exploit Public-Facing Application). In business terms, every unpatched VPN, firewall, or web application stays open to anyone running a public exploit. **Alert fatigue** follows from smaller teams handling the same or higher alert volume. Analysts close low-severity alerts in bulk without investigating them, and queues sit untriaged over weekends. Barracuda reports security head count reductions linked to AI, with human roles moving toward threat investigation and automation governance. If that governance is immature, alerts that automation scores as low priority may go unreviewed by any person. Attackers who log in with stolen credentials (T1078, Valid Accounts) generate exactly those quiet, low-severity signals. Foundry's report adds that forensics analysts are among the hardest roles to fill, which leaves fewer people able to reconstruct what happened once an intrusion surfaces. **Misconfigured cloud resources** appear when workloads move faster than reviews. Foundry found that cloud security tops the list of skills CSOs want their teams to build, and that cloud security architects are among the hardest roles to hire. Without an architect reviewing deployments, teams ship storage buckets with public read access, overly permissive network rules, and exposed management interfaces. Attackers then use those cloud accounts directly (T1078.004) or pull data from exposed storage (T1530), often without touching an on-premises system. **Stale identity and access permissions** build up when access reviews are deferred. Employees change roles and keep old rights, contractors leave with active accounts, and OAuth consent grants to third-party apps are never revisited. This is where the survey's identity findings connect to concrete techniques: - **OAuth abuse:** attackers trick users into granting a malicious app access, then use the token (T1528, Steal Application Access Token). Tokens can stay valid after a password reset. - **MFA bypass:** attackers flood users with push prompts until one is approved (T1621, Multi-Factor Authentication Request Generation) or replay session tokens captured through phishing proxies. - **Business email compromise:** with mailbox access, attackers create inbox rules that hide replies (T1564.008, Email Hiding Rules) while they redirect payments. Over-privileged accounts make each of these worse, because one compromised login reaches more systems and data than the user's job requires. **Unmonitored third-party integrations** round out the list. Integrations connected under deadline pressure often get broad API scopes and no logging review afterward. Attackers who compromise the vendor reach your environment through that trusted connection (T1199, Trusted Relationship). Foundry found that securing agentic AI technology and AI/machine learning-enabled technology rank just behind cloud security as skills priorities. Agentic AI tools typically need wide access across email, files, and business applications to work, so each deployment adds another integration your team has to account for. Across all five weaknesses, the cause is the same: maintenance tasks that produce no visible output (patching, triage, access reviews, configuration checks) are the first to slip when a team is short on people, and attackers target the systems where that work has slipped. ## Practical Steps to Close the Gap Between Security and Business Demand The most important action is to count what your security team is actually being asked to do. Within the next 30 days, have your security lead pull every open security review request and every outstanding patch ticket into one list, with the requesting business unit, the date opened, and the system involved. The steps below are organized around the NIST Cybersecurity Framework, build on that list, and run from the first month through the next year. ### Identify With the backlog visible, sit down with business unit heads and name the five requests that are blocking a launch, a migration, or a vendor onboarding. The CISO or security lead owns this step. Success means each blocker has a named owner and a target date, so your team works the queue by business impact instead of by whoever asked loudest. Over the following one to two quarters, the CISO and HR should build a staffing and skills plan. Foundry's research found that **cloud security architects, AI security specialists, and forensics analysts** were the hardest cybersecurity roles to hire for. Your plan should mark which of these skills you will train internally, which you will buy from a provider, and which you will hire, with a budget line for each. ### Protect Set risk-based service levels for security review intake in the first 30 days. A request touching customer data or internet-facing systems gets a fast, full review. A low-risk internal change gets a lighter check. The security lead owns the tiers, and success is a published turnaround time that business units can plan around. In the short term, cut the volume of reviews that reach the team at all: - **Pre-approved secure patterns:** Document standard configurations (for example, an approved cloud storage setup or SaaS connection template) that let routine requests skip full review. Your security architect owns these, and success is a falling share of requests needing a custom review. - **Security champions:** Name one trained engineer in each product and engineering team to handle first-pass questions. Engineering managers own the selection, and the security lead owns the training. - **Tool consolidation:** Retire overlapping tools so analysts maintain fewer consoles. The security operations manager owns the review, with a target of a smaller, documented toolset by the end of the second quarter. ### Detect Automate repetitive alert triage and ticket enrichment (pulling asset owner, user details, and threat context into a ticket automatically). Barracuda's research describes AI taking on routine analysis and response work while people shift toward threat investigation and automation governance. In practice, someone on your team must own the rules the automation follows and review its decisions. Where you lack overnight staff, contract managed detection or MSSP coverage for after-hours monitoring, with a written escalation path to an internal decision-maker. ### Respond Assign incident leadership as a named role with a deputy. Then run cross-training so every critical system has at least two people who can carry out its response playbook. The security operations manager owns the rotation, and success is a tabletop exercise completed without the usual expert in the room. ### Recover Over the longer term, your CISO should report security capacity to the board as its own named risk item, with the backlog list as evidence. Align security metrics with business KPIs such as review turnaround time, projects delivered on schedule, and security projects abandoned or restarted. Review those figures each quarter and restart any stalled project that still addresses a current risk. The AI Workforce Consortium's research points to a growing need for practical experience and human skills, so put part of the training budget into hands-on exercises and incident simulations alongside certifications. Clearing the security review backlog with the NIST Cybersecurity Framework Phase 1 Inventory the backlogThe security lead gathers every open review request and outstanding patch ticket into one list. Each entry records the requesting business unit, date opened, and system involved. Phase 2 Identify: name the blockersThe CISO works with business unit heads to find requests blocking launches, migrations, or vendor onboarding. Each blocker gets a named owner and target date, and the queue is worked by business impact. Phase 3 Protect: set risk-based review tiersRequests touching customer data or internet-facing systems get a full review, and low-risk internal changes get a lighter check. The security lead publishes a turnaround time that business units can plan around. Phase 4 Protect: cut review volumePre-approved secure patterns let routine requests skip full review, and trained security champions handle first-pass questions in each engineering team. Overlapping tools are retired so analysts maintain fewer consoles. Phase 5 Identify: plan staffing and skillsThe CISO and HR decide which hard-to-hire skills to train internally, buy from a provider, or hire, with a budget line for each. These skills include cloud security architecture, AI security, and forensics. ## Treating Security Capacity as a Measured Business Risk The survey finding that most security teams cannot keep up with business demand points to a structural mismatch. Business units add cloud workloads, vendors, and AI tools faster than security teams can grow. Foundry's report adds that the hardest roles to fill are cloud security architects, AI security specialists, and forensics analysts, which are the roles that newer work depends on. The result is real exposure in the form of delayed reviews, aging patches, and alerts nobody has time to investigate. The single most important action is to measure your security backlog and report it to your executive leadership as a tracked risk metric. Three counts cover most of it: open security review requests, outstanding patches on internet-facing and business-critical systems, and unresolved alerts. Report each one with its age and the business unit it affects, on the same schedule your leadership uses for financial or operational risk. Tracked over several quarters, those counts show your executives whether the gap is widening or closing. They also give you a factual basis for resourcing requests, whether the answer is new hires, outsourced support, or automation for routine analysis. Your leadership can then make staffing decisions based on measured exposure rather than anecdote, and you can show whether a funded change actually reduced the backlog. Barracuda's Siroui Mushegian described the goal as reshaping security teams so that AI and automation work alongside human expertise, judgment, and visibility. A backlog metric shows you where that human judgment is currently stretched too thin to cover the work. If you are unsure how large your own backlog is or which open items carry the most exposure, a [security assessment](https://captechgroup.com/security-assessment) can establish that baseline before you present your first backlog report to leadership. ```json { "@context": "http:\/\/schema.org", "@graph": [ { "@type": "Article", "author": { "@id": "https:\/\/captechgroup.com\/#brian_0fd5dfcdbc" }, "dateModified": "2026-11-03T12:35:33Z", "datePublished": "2026-11-03T12:35:33Z", "description": "Barracuda's survey of 2,000 IT and security decision-makers finds 67% of teams struggle to scale. Skills gaps fuel patch backlogs, OAuth abuse, and MFA bypass.", "headline": "67% of Security Leaders Say Their Teams Struggle to Meet Business Needs", "image": [ { "@type": "ImageObject", "url": "https:\/\/images.captechgroup.com\/cdn-cgi\/image\/width=1200,format=webp,quality=85\/threat-intel\/71bca748fb.jpg", "caption": "", "description": "Blueprint of an overloaded security team's network with a request backlog and an unpatched gateway exposed to attack", "width": 1200, "height": 685 } ], "inLanguage": "en-GB", "mainEntityOfPage": { "@type": "WebPage", "url": "https:\/\/captechgroup.com\/threat-intelligence-center\/67-of-security-leaders-say-their-teams-struggle-to-ffc085" }, "publisher": { "@id": "https:\/\/captechgroup.com\/#defaultPublisher" }, "url": "https:\/\/captechgroup.com\/threat-intelligence-center\/67-of-security-leaders-say-their-teams-struggle-to-ffc085" }, { "@type": "Person", "name": "Brian", "@id": "https:\/\/captechgroup.com\/#brian_0fd5dfcdbc" }, { "@id": "https:\/\/captechgroup.com\/#defaultPublisher", "@type": "Organization", "url": "https:\/\/captechgroup.com\/", "logo": { "@id": "https:\/\/captechgroup.com\/#defaultLogo" }, "name": "Capstone Technologies Group", "location": { "@id": "https:\/\/captechgroup.com\/#defaultPlace" } }, { "@id": "https:\/\/captechgroup.com\/#defaultLogo", "@type": "ImageObject", "url": "https:\/\/captechgroup.com\/images\/hotlink-ok\/logo-light.jpg", "width": 1300, "height": 300 }, { "@id": "https:\/\/captechgroup.com\/#defaultPlace", "@type": "Place", "address": { "@id": "https:\/\/captechgroup.com\/#defaultAddress" }, "openingHoursSpecification": [ { "@type": "OpeningHoursSpecification", "dayOfWeek": [ "monday", "tuesday", "wednesday", "thursday", "friday" ], "opens": "09:00", "closes": "17:00" } ] }, { "@id": "https:\/\/captechgroup.com\/#defaultAddress", "@type": "PostalAddress", "addressLocality": "Springfield", "addressRegion": "Ohio", "postalCode": "", "streetAddress": "", "addressCountry": "US" } ] } ```