Cyber resilience spending continues to rise, but investment in technology alone does not guarantee that an organization can recover when an attack reaches critical systems.
The numbers expose the disconnect.
According to ISC2’s 2025 Cybersecurity Workforce Study, 95% of cybersecurity professionals report at least one skills need within their teams, while 59% report critical or significant skills needs. More importantly for technology leaders, 88% have experienced at least one significant cybersecurity consequence because of skills deficiencies.
At the same time, the financial consequences of cyber incidents remain substantial. IBM’s 2025 Cost of a Data Breach Report puts the global average cost of a data breach at US$4.44 million.
For CIOs and CISOs, these figures point to an increasingly important conclusion:
Cyber resilience depends not only on the technology an organization deploys, but on whether its people have the skills to operate and recover that technology when it matters most.
The Cyber Skills Problem Has Changed
For years, the cybersecurity talent conversation centered on headcount.
Today, the challenge is increasingly about capability.
ISC2’s 2025 research found that only 5% of respondents believe their teams have no current cybersecurity skills needs. AI was identified as the most pressing skills requirement by 41%, followed by cloud security at 36%.
That distinction matters.
An organization can have a fully staffed IT department and still lack sufficient expertise in recovery orchestration, cloud security, data protection, incident response or modern resilience architecture.
In fact, ISC2 found that skills shortages were already creating tangible operational consequences: 26% reported oversights in cybersecurity processes and procedures, 25% had placed underqualified or inexperienced employees into roles, and 24% reported problems with misconfigured systems.
For CIOs and CISOs, the risk is therefore no longer simply, “Do we have enough people?”
It is:
“Do the people we have possess the right skills for the environment we now operate?”
Recovery Is Where Skills Become Business-Critical
Ransomware makes this distinction particularly visible.
Veeam’s 2025 ransomware research surveyed 1,300 organizations, including 900 organizations that had experienced at least one ransomware attack involving encryption or data exfiltration during the previous 12 months.
Interestingly, 98% of organizations surveyed reported having a ransomware response playbook.
That sounds reassuring.
But having a documented response strategy and being operationally prepared to execute it are two very different things.
During a real incident, teams may need to identify clean recovery points, understand workload dependencies, protect backup environments, coordinate infrastructure recovery, validate recovered systems and determine the correct sequence for restoring business-critical applications.
Those decisions are being made while the business is already under pressure.
That is why recovery expertise cannot begin on the day of an attack.
Your Recovery Architecture Is Only as Resilient as the Team Operating It
Organizations have invested heavily in sophisticated backup and recovery platforms.
Yet even advanced technology can be undermined by configuration errors, incomplete knowledge or operational dependency on a small number of specialists.
ISC2’s findings make this particularly relevant: 24% of cybersecurity professionals reported misconfigured systems as a consequence associated with skills shortages, while another 24% said skills deficiencies prevented their organizations from taking advantage of emerging cybersecurity technologies.
For an IT leader, this represents two forms of risk.
The first is operational risk: technology may not perform as expected because the organization lacks sufficient expertise to configure or operate it correctly.
The second is investment risk: organizations may purchase sophisticated platforms while using only a fraction of their capabilities.
Training therefore shouldn’t be viewed solely as an HR or employee-development expense.
In a cyber resilience environment, it is part of protecting the technology investment itself.
From Veeam Deployment to Veeam Capability
For organizations using Veeam, there is an important distinction between owning the platform and developing organizational capability around the platform.
A Veeam deployment provides technology.
A Veeam-skilled team provides the ability to architect, monitor, manage and recover the environment with greater confidence.
Structured technical training can help teams develop deeper knowledge across areas including Veeam Data Platform, Veeam ONE, Veeam Recovery Orchestrator and enterprise data protection.
This becomes particularly important as infrastructure environments grow more distributed and recovery requirements become more complex.
The question for CIOs and CISOs should therefore not simply be:
“Do we have Veeam?”
It should be:
“How many people in our organization could confidently use it to recover our critical environment tomorrow?”
That is a very different measure of resilience.
Training Should Be Part of the Resilience Budget
The global cybersecurity skills challenge also shows why organizations cannot rely exclusively on external hiring.
ISC2 estimated the global cybersecurity workforce at approximately 5.5 million professionals in 2024, while estimating an additional 4.8 million-person workforce gap. At the time, 90% of respondents reported cybersecurity skills gaps within their organizations.
In the European Union specifically, ISC2 previously estimated a cybersecurity workforce gap of approximately 274,000 professionals.
Organizations therefore need another strategy alongside recruitment:
developing the people they already have.
For CIOs, this means treating technical education as part of infrastructure planning.
For CISOs, it means incorporating skills readiness into resilience and recovery assessments.
And for technology leaders broadly, it means recognizing that certification and advanced technical training can contribute directly to reducing organizational dependency on scarce expertise.
Three Questions Every CIO and CISO Should Be Asking
The next cyber resilience review should go beyond asking whether backups exist or whether a recovery plan has been documented.
Leadership should ask:
1. If a ransomware incident occurred tomorrow, who could actually execute the recovery?
Not who owns the process on paper — who has the technical knowledge to perform it.
2. Is that expertise distributed across the team?
If one engineer holds most of the organization’s recovery knowledge, the organization has created a human single point of failure.
3. Are we using the full capabilities of the technology we’ve already purchased?
If advanced monitoring, orchestration, automation or recovery capabilities remain unused because teams lack training, the organization may be carrying both security risk and unrealized technology investment.
Cyber Resilience Is Technology + Process + People
Cyber resilience cannot be purchased as a product.
It is built through the combination of resilient technology, tested processes and technically capable people.
With the average data breach still costing organizations millions of dollars and cybersecurity teams reporting widespread skills deficiencies, developing technical capability should be treated as part of the resilience strategy — not as an optional training initiative.
Through Tsunati University, IT professionals can access Veeam-focused training designed to deepen practical expertise across data protection, monitoring, recovery and orchestration.
For CIOs and CISOs, the objective goes beyond adding another certification to the team’s credentials.
It is about building an organization where, when recovery becomes business-critical, the expertise required to execute it already exists inside the team.
Build the skills behind your cyber resilience strategy with Tsunati University
Add your first comment to this post