ResilienceandtheCybersecuritySkillsGap

Resilience in critical digital infrastructure, particularly energy, is increasingly threatened by a persistent shortage of cybersecurity professionals. This gap is more than a technical deficit; it is a systemic risk to cybersecurity frameworks [3][26]. Cybersecurity is not solely a technical concern, but also a managerial and economic concern [4][5].

NIST [27] emphasizes managerial controls and staff awareness [23], while ongoing threat evolution necessitates continuous updates to skills and policies [28]. The NIST “Information Security Handbook” supports agency managers in implementing effective security programmes [28]. Furthermore, human behavior and perception influence effectiveness [17], indicating that a sociotechnical approach is essential. Skill shortages across sectors limit efforts to operationalize frameworks, especially in highly regulated and high-risk contexts, such as energy [20].

CybersecurityWorkforceCapability

Workforce capability is central to infrastructure resilience. Malatji et al. [3] presented a 29-domain model based on NIST [27][29], covering areas such as cloud, IoT, and industrial cybersecurity [24], but noted critical gaps in practical applications. Khaw et al. [14] identified four capability pillars—individual, organizational, technological, and governmental—that form an interacting ecosystem rather than isolated skill sets.

Otoom et al. [30] promoted EduCERT, a collaborative educational framework for cross-sector knowledge exchanges. Security culture is also vital, yet is often overlooked in training [31]. Haney and Lutters [13][26] highlighted the importance of cybersecurity advocates who require soft skills, such as communication and persuasion, which are underrepresented in traditional curricula.

Due to the ever-evolving nature of cybersecurity [14][32], adaptability and continuous learning are critical. Economic incentives should also be considered to support talent retention and development [33]. Thus, workforce capability encompasses not only technical knowledge, but also culture, attitude, and economic sustainability.

Sector-SpecificCybersecurityNeeds

Cybersecurity needs differ significantly by sector owing to varying industrial, technological, and regulatory contexts. In the energy sector, convergence between Industrial Control Systems (ICS), Supervisory Control and Data Acquisition (SCADA), and the IoT introduces complex vulnerabilities [3]. SCADA is a type of Industrial Control System (ICS) used to monitor and control infrastructure and facility-based processes. These systems are essential for sectors such as energy, water, transportation, and manufacturing. An ICS is a broader term that includes both SCADA and Distributed Control Systems (DCSs). While SCADA involves centralized control with remote sensors and operator terminals, DCS distributes control functions across processors located near the instruments or devices that collect the data. Both play a critical role in monitoring and managing infrastructure systems [28].

Thomas and Sule [4] argued that technical skills alone cannot address these complexities. Thus, holistic frameworks that integrate compliance, safety, and risk management are required. Yeboah-Ofori and Opoku-Boateng [34] noted that multivendor environments further complicate workforce requirements, demanding expertise in interoperability and contracts.

The other sectors face parallel challenges. Healthcare contends with electronic health record systems vulnerabilities, similar to SCADA systems or issues [35]. Thus, Electronic Health Records (EHR) are digital patient records. Finance suffers from high staff turnover, which disrupts privacy and compliance [5]. Railways depend on workforce awareness to secure transport systems [6], while in e-government, skill gaps delay secure service provision [28].

Cultural perceptions are also important. Trust and user values shape adoption [24][36], and robust frameworks can fail without management support [23]. Thus, sector-specific needs combine the technological, human, cultural, and regulatory components.

OperationalizingCybersecurityinHigh-RiskEnvironments

High-risk regulated sectors face difficulties in translating frameworks into operational practices. Although standards exist [4], workforce shortages hamper consistent implementation. Legacy systems complicate staff efforts to apply compliance controls [3]. Orji and U-Dominic [24] underscored the need for cyber risk management in 3PLs to support social sustainability in supply chains. However, persistent challenges continue to impede cyber-security. These barriers are worth exploring further.

Friday et al. [18] emphasize that resilience depends on inter-firm coordination, especially as infrastructure supply chains become more integrated. Bechara and Schuch [15] show that international frameworks work only if the staff can adapt them locally. Managerial practices are essential [23], and ongoing reassessment is required to address shifting threats [32]. Behavioral factors also matter; user perceptions directly influence success [36]. Effective cybersecurity in such settings requires technical, managerial, and cultural alignments.

EmergingThemes:AI,Industry4.0,andCyber-PhysicalConvergence

New technologies have increased workforce demand. Graham [9] notes that AI-driven security requires skills in machine learning, ethics, and data science. Industry 4.0 calls for professionals who combine cybersecurity and engineering expertise [16]. Lifelong learning must be embedded in order to keep pace [10][26].

The energy sector’s shift to smart grids reflects broader trends in cyber-physical convergence in smart cities [37] and medical IoT [17], where more connected systems create greater vulnerabilities. Skills must be constantly renewed [32] and policies must support long-term learning [26]. NIST frameworks [27][29] provide guidance, but depend on an agile, well-trained workforce.

Cross-SectorInsightsandWorkforceStress

Workforce stress is an underappreciated vulnerability. Singh et al. [22] showed that pressure-filled environments degrade performance and cause attrition, exacerbating skill shortage. Spruit [12] suggests standardized frameworks, such as European e-Competence Framework (European e-CF), to align expectations and reduce overload. The European e-Competence Framework (e-CF) is a standardized reference that defines 40 Information Communication Technology (ICT) professional competences, helping to align roles and responsibilities across organizations and countries. It supports HR processes, such as recruitment, training, and career development, while also reducing role ambiguity by clearly outlining expectations.

Kour and Karim [6] found that railway staff are overwhelmed by compliance burdens, impacting morale. Chen and Zahedi [36] stressed that perceptions and attitudes shape stress outcomes. Lawelai et al. [26] proposed economic support for mental health, whereas Asbaş and Tuzlukaya [32] emphasized adaptable training to reduce burnout. Managerial commitment is crucial for creating supportive environments [17]. Addressing well-being is essential to address technical proficiency.

ImplicationsfromExtantLiteratureforResilienceandPolicy

The literature has consistently shown that cybersecurity workforce shortages erode infrastructure resilience. Insufficient staffing delays threat detection and recovery [16], undermines compliance [4], and reduces public trust [38]. Skill gaps also hinder the adoption of advanced tools such as AI [9].

Policies alone are not sufficient. Managerial practices must align with regulatory goals [33], and financial and legislative support is necessary for workforce Orji and U-Dominic [24] advocated for policies attentive to culture and user perception. Lawelai et al. [26] underscored the importance of dynamic and evolving policies. Ultimately, policies should prioritize skill development, mental health, and workforce resilience to ensure secure, uninterrupted critical services.

Table 2 presents a synthesized overview of the existing research, highlighting various viewpoints on the capabilities of the cybersecurity workforce and their influence on the resilience of critical infrastructure.

Table 2. Summary of key literature insights.

Malatji et al. [3] and Khaw et al. [14] proposed comprehensive frameworks outlining the multidomain skills required to meet evolving cybersecurity challenges. Haney and Lutters [13] emphasized the importance of soft skills and human factors, while Graham [9] and Stavrou and Piki [10] highlighted competencies related to artificial intelligence and lifelong learning.

Sector-specific studies such as Kour and Karim [6] in the railway sector and Mwogosi and Simba [35] in healthcare illustrate how workforce gaps are tied to the operational context of each domain. These findings challenge generic workforce models and suggest that tailored development strategies are necessary. Similarly, Lawelai et al. [26] and Lnenicka et al. [37] explored smart cities and demonstrated how governance and policy must be aligned with evolving workforce needs.

This table also includes research on psychological well-being and stress among cybersecurity professionals. Singh et al. [22] and Spruit [12] showed that retention and mental health are integral to resilience, broadening the conventional focus on technical skills to encompass organizational culture and staff support.

Policies and governance are central to this process. Bowen et al. [23] and Bechara and Schuch [15] argue that international frameworks and managerial practices are effective only when paired with capable and well-supported personnel. Anderson and Moore [39] added an economic lens, noting how incentives and cost structures influence recruitment, training, and retention.

Collectively, Table 2 underscores that addressing workforce gaps requires a holistic strategy that spans technical skills, sector-specific expertise, organizational well-being, and supportive policy infrastructure. A resilient cybersecurity ecosystem depends on a trained, motivated, and context-aware workforce that is supported both technically and psychologically.

SynthesisofLiteratureandResearchGaps

The literature review highlights a multidimensional challenge linking cybersecurity skills gaps to infrastructure resilience. Evidence from the energy, health, finance, and transportation sectors confirms that workforce capability is central to cybersecurity effectiveness. However, this capability remains inconsistently developed across sectors, weakening the overall resilience. The convergence of IT and OT, the growth of Industry 4.0, and AI adoption amplify the demand for specialized skills. However, outdated training models, fragmented educational pipelines, and weak cross-sector collaboration have hindered workforce development. Additionally, psychological strain among cybersecurity staff increases burnout and attrition risk. Policy frameworks alone cannot secure infrastructure without a skilled workforce to implement them.

Organizational and sectoral variations also prevent universal solutions. For instance, the energy sector relies on long-life cycle industrial control systems, creating mismatches with modern tools. Financial services face intense compliance and high staff turnover, and healthcare must secure systems without compromising patient care. These examples highlight the importance of sector-specific strategies.

The skills gap also interacts with supply chain risk. Many energy organizations outsource IT services but lack in-house cybersecurity expertise to assess contractor practices and compound vulnerabilities. Supplier weaknesses can become entry points for attackers, as in other sectors.

Finally, there is a lack of empirical research on how workforce shortages directly disrupt daily cybersecurity functions such as patching, scanning, detection, and response, especially in energy environments. Field studies and mixed-methods research can illuminate how technical deficits and human factors intersect in real-world settings.

In a nutshell, cybersecurity workforce capability is a crucial and under-explored component of infrastructure resilience. Future research should develop sector-specific training models, investigate educational and career pathways, and address workforce well-being and policy mechanisms to build a sustainable and adaptive cybersecurity labor force.

CaseStudy1:Third-PartyVendorCompromiseinaRegionalEnergyUtility

A regional utility in the U.S. Midwest initiated a modernization effort integrating Advanced Metering Infrastructure (AMI) with outdated Supervisory Control and Data Acquisition (SCADA) systems. This convergence was facilitated by a third-party Internet of Things (IoT) vendor whose technicians were granted persistent Virtual Private Network (VPN) access to critical infrastructure, a common but hazardous configuration in combined Information Technology/Operational Technology (IT/OT) environments.

The incident began when a technician’s credentials were compromised during a phishing attack. An attacker uses the vendor’s VPN to pivot laterally into the utility network. Although network segmentation flagged unusual queries to the SCADA control panels, “ittooknearlytwodaystoisolatethethreat”. During this window, multiple internal systems are probed, triggering an operational alarm.

Interview data relating to this case indicate deep dysfunctions in incident handling. Engineers feared cutting power unintentionally by acting without a full system understanding. Analysts cannot distinguish legitimate vendor traffic from malicious activities. Only one staff member had experience in both SCADA protocols and IT security tools. This personnel shortfall left the organization vulnerable during the critical breach period.

This case highlights that even sophisticated technical defenses cannot substitute for personnel capable of interpreting and managing converged systems. This event affirms Lawelai et al. [26], who emphasized the need for hybrid-skilled professionals in digitally modernized utilities to uphold resilience during cyber disruptions.

CaseStudy2:MalwareContainmentChallengesat“EnergyCo”

“EnergyCo” (pseudonym), a leading independent fuel distributor, migrated its dispatch systems to a hybrid cloud to coordinate fuel logistics across regional terminals. This transformation was intended to enhance responsiveness and real-time visibility but introduced new risks from increased interconnectivity.

The incident occurred when a contractor plugged into a personal laptop infected with malware during a VPN session. Although anomaly detection tools immediately flagged the behavior, the malware had already spread to dispatch subnets. Isolating the terminals posed a dilemma: disconnection increased the risk of halting fuel deliveries during a seasonal demand spike.

Interviews with participants in this case revealed paralyzed decisions and insufficient capacity. The only cloud security expert worked over 24 h alone, with no backup. Dispatch staff hesitated, fearing systemic service outages. Analysts deferred action owing to unclear escalation paths and segmentation knowledge gaps. A contractor reported, “Ididn’tknowwhohadauthority—everyonefroze”.

This case underscores that even low-sophistication malware can overwhelm organizations that lack redundancy and clear roles. Technical tools provide alerts, but skilled people are not able to interpret them under operational pressure. Delays widened the threat window and disrupted fuel supply to the entire region.

These findings reinforce Thomas and Sule [4], who argued that resilience frameworks must be underpinned by a workforce with both technical expertise and domain-specific judgment. EnergyCo’s challenges illuminate human bottlenecks that persist even in cloud-mature environments.

CaseStudy3:VulnerabilityManagementinaMetropolitanTransportationAuthority

A major U.S. transit authority modernized its signaling systems, transitioning from analog infrastructure to a Communication-Based Train Control (CBTC) platform. This included integration with third-party predictive maintenance tools through Application Programming Interfaces (APIs) hosted in the cloud.

During a routine audit, a critical vulnerability was found in an API bridging the Software as a Service (SaaS) platform and on-premises training systems. This flaw enabled potential command injection into a safety-critical infrastructure. Despite the urgency, patching took over three months due to a shortage of personnel skilled in both secure software development and railway operations.

Interviews with participants in this case revealed a fractured organizational response. Security Operations Center (SOC) analysts were reluctant to act, fearing that they might disable the train safety mechanisms. One participant said, “Thiswasn’tastandardLinuxbox—wedidn’tknowwhatfailurelookedlikehere”. Conversely, rail engineers distrusted the cybersecurity team’s understanding of control systems. One commented, “Theyapproachedthislikepatchingawebsite, notoperatingatransitsystem”. Staff burnout is also widespread. Several employees were juggled by routine incidents and this high-risk vulnerability without sufficient support. The required cross-functional collaboration never materialized because of rigid departmental boundaries and cultural mistrust.

This case demonstrates that technically solvable vulnerabilities can remain dangerous if interdisciplinary cooperation fails. As Friday et al. [18] argued, effective cybersecurity in critical infrastructure demands shared mental models, not just advanced tooling. In this case, the socio-technical gap, not the flaw itself, posed the greatest threat to public safety.

CaseStudy4:AdversarialMachineLearningAttackinaFinancialInstitution

A large national bank has adopted a Machine Learning (ML) engine to detect fraud in real time across transactions processed by financial technology (fintech) partners via API integration. The system was designed to enhance precision without delaying legitimate transactions.

Attackers exploit a misconfigured API key from the partner firm by injecting adversarial data into the model. This caused a spike in false positives, freezing thousands of legitimate transactions and triggering a customer service crisis. The incident marked a textbook example of model poisoning, a novel and poorly understood threat at the time.

Interview data relating to this case revealed confusion and slow responses. Fraud analysts lack insight into ML behavior and cannot override their decisions. Cybersecurity personnel, unfamiliar with adversarial techniques, relied on external consultants who arrived 36 hours later. A data scientist reflected, “Wecouldn’texplainmodelbehaviorinawaytheyunderstood. Theythoughtinfirewalls, wethoughtintensors”. The absence of interdisciplinary fluency delayed containment and eroded trust between departments. Moreover, customer confidence was shaken by banks’ lack of transparency and control.

This case underscores the need for hybrid-skilled professionals who can bridge the cybersecurity and artificial intelligence domains. This event supports Kandpal et al. [5], who call for a new skills architecture to support resilience in AI-driven financial systems. Without teams able to interpret, secure, and act on ML insights, the system’s sophistication becomes a liability.

CaseStudy5:Multi-VectorCyberattacksinaNationalTelecomProvider

A national telecommunications company embarked on a major digital transformation to accelerate its 5G rollout and consolidate billing, customer service, and Internet of Things (IoT) management through centralized cloud infrastructure. Multiple third-party vendors have managed core systems to support rapid scaling.

Over a two-week period, the provider experienced coordinated cyberattacks involving phishing, ransomware, and Distributed Denial-of-Service (DDoS) techniques. A phishing email compromised the billing administrator’s credentials, enabling lateral movement into customer databases. Simultaneously, ransomware is deployed through a misconfigured API linked to a third-party billing platform. The crisis peaked when a DDoS attack took down public-facing systems, disabling mobile data in several cities.

Interviews with participants in this case revealed severe breakdowns in coordination and response. The SOC teams could not correlate with different attack vectors. One network engineer said, “Everythingwasonfire—emailservers, routers, billingsystems—andnooneknewwheretostart”. Executive hesitation, partly due to fear of regulatory scrutiny, delayed full-scale incident response. Vendor oversight is limited. One executive admitted, “Thebillingplatformwasablackbox—wedidn’tknowitsvulnerabilities”.

Despite previous investments in Information and Communications Technology (ICT) security, siloed teams, inadequate staffing, and fragmented monitoring have left companies vulnerable to multi-vector exploitation. Analysts have been confined to outdated threat models and lack real-time threat correlation tools.

This case validates Ncube, Sishi, and Skinner [46], who argue that systemic resilience in telecoms hinges on sociotechnical integration. Complex infrastructures require not only digital sophistication but also unified governance, interoperable teams, and continuous organizational learning. A summary of these findings is presented in Table 3.

The following section presents practitioners’ insights from the energy sector, gathered during a focus group interview.

A key informant working in the energy sector described how recent cybersecurity incidents, specifically vendor account compromises and cross-site attacks, have exposed significant vulnerabilities within existing organizational structures. “Thesearen’tjusttechnicalfailures”, the informant explained, “theyshowhowdisconnectedourtechnicaldefensesarefromtherestoftheorganization”.

From the practitioner’s perspective, these events have clarified that a purely technical approach to cybersecurity is no longer sufficient. “Weneedpeoplewhounderstandboththetechandthebusiness—whocantranslaterisksintoactionacrossdepartments”, another informant emphasized. This aligns with the perspective of Haney and Lutters [13], who argue that cybersecurity advocates must “bridgeculturalandoperationaldividesacrossIT, security, andbusinessfunctions”.

A third participant in the focused group interview stressed that the complexity of the energy sector requires a holistic, cross-functional skill set: “Youcanhavethebesttoolsinplace, butifyourteamsdon’tknowhowtoalignthemwithreal-worldoperations, you’restillvulnerable.” Technical controls, no matter how advanced, must be coupled with strategic human expertise and embedded within organizational policies and workflows. As the informant concluded, “Cybersecurityresilienceisn’tjustaboutfirewallsandpatches—it’saboutpeople, process, andpurpose”.

This study offers important insights for practitioners and policymakers to enhance the resilience of critical digital infrastructures. The acute shortage of skilled cybersecurity professionals, especially in energy, finance, and transportation, is not merely a workforce issue but a systemic operational risk with broad consequences. Addressing this risk requires moving beyond technical fixes toward greater emphasis on human capabilities, sector-specific expertise, and organizational integration.

To facilitate clear traceability: data → themes → framework; and to strengthen the theoretical contribution of this study, a mapping table (Table 5) is presented below to explicitly link each empirical theme to its corresponding component in the conceptual frameworks. This makes the theoretical development more transparent and demonstrates how the frameworks are grounded in both the empirical data and the literature.

Table 5. Mapping of empirical themes to conceptual framework components.

FromThemestoConceptualFramework—LinkingEmpiricalThemestoConceptualFrameworkDevelopment

The conceptual frameworks presented in Figure 1 and Figure 2 were directly derived from the thematic analysis of the empirical data. Following axial coding, four core themes were identified: 1) workforce shortages and burnout, 2) hybrid skill gaps, 3) coordination breakdowns and organizational silos, and 4) cultural and regulatory constraints on incident response.

Figure 2. Conceptual framework on cybersecurity skills gap impact pathway.

These themes were systematically translated into higher-order conceptual components through an iterative abstraction process. Specifically, workforce shortages and hybrid skill gaps were integrated into the central construct of Cybersecurity Workforce Capability, representing the foundational human capacity required for resilient operations. Coordination breakdowns and organizational silos informed the component Operationalisation Challenges, capturing barriers to translating cybersecurity knowledge into effective practice. Cultural and regulatory constraints were conceptualized under Sector-Specific Needs, reflecting how institutional environments shape cybersecurity decision-making and response behavior.

In addition, insights from both the literature review and empirical cases regarding rapid technological change (e.g., AI, IoT, and IT/OT convergence) were incorporated into the component Emerging Technologies, representing evolving demands on workforce capability.

Together, these components were synthesized into an integrated socio-technical framework (Figure 1), illustrating how workforce capability interacts with sectoral context and operational conditions to produce resilience outcomes. The second framework (Figure 2) further extends this mapping by translating the same themes into a causal pathway, showing how workforce shortages lead to operational gaps, increased vulnerabilities, and ultimately reduced infrastructure resilience.

This explicit mapping (Table 5) ensures that the conceptual frameworks are empirically grounded and analytically traceable to the underlying data.

UnveilingaConceptualFrameworkforInfrastructureResilience

A key contribution of this study is the development of a Conceptual Framework to help practitioners and policymakers understand how cybersecurity workforce capabilities dynamically support critical infrastructure resilience. At its core, this framework positions cybersecurity workforce capability as the foundation of resilience.

The frameworks (Figure 1 and Figure 2) are informed by gaps identified in the Systematic Literature Review, and challenges surfaced in five in-depth empirical case studies across the energy, transportation, financial, and telecommunications sectors. The conceptual framework in Figure 1 offers a systems-oriented view of how cybersecurity workforce capability interacts with sectoral demands, operational contexts, and emerging technologies to reinforce resilience in a critical digital infrastructure.

At the core of the framework is Cybersecurity Workforce Capability, which represents the skills, competencies, and institutional knowledge needed to defend mission-critical systems. Based on multi-sector case studies and a Systematic Literature Review, this study shows that the workforce capability is not static. Continual development and investment are required to adapt to evolving threats, particularly in high-risk sectors such as energy, finance, and transportation.

Surrounding this central capability are three interdependent drivers:

Sector-SpecificNeeds

Each sector had distinct operational realities. For example, the energy sector must secure legacy Operational Technology (OT) that converges with modern IT, while finance grapples with high-volume transactional risks and strict compliance regimes. The framework underscores that cybersecurity strategies must be tailored, and sector-specific knowledge, regulatory fluency, and mission alignment are essential.

OperationalisationChallenges

These barriers prevent cybersecurity knowledge and frameworks from being translated into sustainable practice. Legacy systems, fragmented governance, complex supply chains, and cultural divides between IT, OT, and business units hinder their execution. Cyber professionals must not only possess technical skills but also integrate security into daily operations and workflows.

EmergingTechnologies

The rapid integration of artificial intelligence, blockchain, and the industrial IoT presents new opportunities and risks. As technology evolves, so do threat vectors. Without proactive upskilling, advanced tools fail to deliver resilience. The workforce must remain current, with both innovation and associated vulnerabilities.

Figure 1 visualizes these three elements as overlapping circles feeding into a Resilient Critical Digital Infrastructure, symbolizing how workforce dynamics collectively sustain resilience. This framework helps practitioners identify where targeted investments in skills, contextual knowledge, and technological readiness are urgently needed.

Importantly, feedback arrows from “Resilient Infrastructure” back to workforce capability represent an adaptive loop. A resilient environment supports continuous learning, reduces burnout, and promotes confidence, thereby allowing cybersecurity professionals to move from reactive firefighting to strategic initiatives. Strong infrastructure also reinforces the security culture and enables long-term professional development.

Thus, the framework positions the cybersecurity workforce as a linchpin connecting people, processes, and technologies. This affirms that resilience cannot be achieved through tools alone; skilled, adaptable, and sector-aware professionals are essential to designing and evolving effective cybersecurity programs for critical infrastructure.

AConceptualFrameworkMappingtheImpactofCybersecuritySkillsGapsonInfrastructureResilience

The second framework, theCybersecuritySkillsGapImpactPathway (Figure 2), illustrates how cybersecurity workforce shortages degrade the resilience of critical digital infrastructure. Drawing from the five case studies in the energy, transport/logistics, and financial sectors, it maps a causal pathway to show how workforce gaps translate into systemic risk. The model is intended to help practitioners view workforce issues as operational and security-critical threats, rather than isolated HR challenges.

The pathway includes five sequential stages:

WorkforceShortages

All sectors examined face acute shortages of skilled cybersecurity professionals capable of managing increasingly complex cyber-physical systems. These shortcomings stem from a limited supply of qualified candidates, skill mismatches, and rapid technological changes outpacing education and training systems.

OperationalGaps

Insufficient staffing leads to delays in core functions such as patching, monitoring, incident response, and compliance. These gaps weaken cybersecurity hygiene and hinder the integration of security practices into organizational processes, particularly in sectors with converging legacy operational technology (OT) and modern Information Technology (IT).

IncreasedVulnerabilities

Latent vulnerabilities persist as operational gaps persist. Systems remain unpatched, misconfigurations go unnoticed, and supply chain risks are assessed inadequately. These issues have accumulated and exposed critical systems to exploitation.

HigherAttackRisks

Unaddressed vulnerabilities increase the risk of a successful attack. Sophisticated threat actors, including ransomware groups and state-sponsored adversaries, scan for such weaknesses and target under-defended infrastructures using known tactics and procedures.

ReducedInfrastructureResilience

Ultimately, resilience—the ability to anticipate, withstand, recover from, and adapt to cyber incidents—declines. The cumulative impact of staffing shortages and security gaps renders systems fragile and less responsive to crises.

A key feature of the framework is the feedback loop from “Reduced Infrastructure Resilience” back to “Workforce Shortages”. Repeated security failures, stress, and dysfunctional response environments drive burnout, attrition, and reduced attractiveness of cybersecurity roles, compounding the skill gap. Practitioners must recognize and disrupt this cycle by prioritizing workforce well-being, training, and retention.

Figure 2 demonstrates that skill gaps are not isolated HR concerns; they propagate through operational systems, escalating into organization-wide vulnerabilities. A well-supported, cross-functionally trained cybersecurity workforce is essential for maintaining resilience in mission-critical infrastructure.

For policymakers, this framework highlights the need for sector-specific training initiatives, interdisciplinary funding strategies, and integrated workforce development programs. Resilience policies must account for not only technical standards, but also the human capacity needed to implement and adapt them.

Together, Figure 1 and Figure 2 offer a comprehensive, evidence-informed roadmap that positions cybersecurity workforce capability as the link pin of critical infrastructure resilience. Skill shortages must be treated as a foundational risk that requires coordinated strategic actions.

AvenuesforFurtherResearch

There are several directions that merit further exploration. Thus, sector-specific workforce challenges should be examined in greater detail. While this study focused on energy, transportation, finance, and telecommunications, future research should investigate additional high-stakes domains, such as healthcare and water utilities. As Katsuya and Liu [17] and Al-Hawamleh [28] argued, each sector operates under distinct regulatory, cultural, and technical conditions that shape workforce needs.

Comparative international studies could also add value, particularly given the global disparities in cyber maturity and the workforce development infrastructure. Additionally, the role of automation and Artificial Intelligence (AI) in alleviating workforce strain deserves further study. Future research should assess how AI-based tools impact human workload, decision-making, and cognitive stress and how the governance of such tools affects training and job design.

Organizational culture and leadership practices warrant further analysis. Qualitative studies, such as ethnographies or participatory action research, could uncover how leadership attitudes toward workforce readiness influence capacity-building and response effectiveness.

LimitationsofThisStudy

This study has several limitations. The most notable aspect is the scope of the case study sample. While diverse in sectors, the five-case dataset is not intended to be statistically representative. Broader studies with larger and more varied samples would help to validate the observed patterns.

Second, the qualitative nature of the data, based on interviews and document reviews, limits the ability to establish causality or measure the impact. While rich in context, this approach does not quantify relationships, such as between staffing levels and incident frequency.

Finally, the cybersecurity landscape has rapidly evolved. New threats, technologies, and regulations have emerged faster than many organizations can adapt. The findings offer a current snapshot, but ongoing reassessment will be essential to keep workforce strategies aligned with future risks.