DOW Future Cyber Workforce Forecasting Gap Analysis—Final Report

Executive Summary

“The nation’s greatest vulnerability is not technology; it is a workforce unprepared to respond to cyberattack.” ~DOW Cyber Workforce Workshop participants

This report details the findings and recommendations of the SMA Future Cyber Workforce Study conducted by the Strategic Multilayer Assessment (SMA)1 office in the Joint Staff and supported by the Department of War (DOW) office of the Chief Information Officer (CIO). This study supports the DOW CIO Workforce Innovation Directorate (WID) Cyber Workforce Over the Horizon Forecasting Project (CWOH-FP). The aim of the CWOH-FP is to identify gaps in the desired DOW cyber workforce of the future. The study combined traditional desk research with complex system modeling, interviews, and a forecasting workshop to identify gaps in the current and future DOW cyber workforce and provide evidence-based, actionable recommendations to CIO for closing those gaps.

The DOW cyber workforce is generated by a complex system of systems that includes adversarial threats that provide the need for the workforce, cyber technology itself, government organizations that protect the nation from cyber threats, federal policies that impact cyber workforce generation, industries that create cyber and defense technology, educational system that transmits knowledge and skills to future cyber professionals, broad social forces that demand information technology, security, but also at times fears cyber technology itself, and of course, the DOW cyber workforce itself (Figure 1). Specific elements, or nodes, of each of these systems influence nodes within and across these sub-systems, creating an ecosystem with millions of direct and indirect pathways that ultimately influence the generation of the DOW cyber workforce. A major goal of this study was to model this ecosystem and identify leverage points that CIO can impact to close gaps in the future DOW cyber workforce.

CIO initially presented the SMA team with four core questions:

1. What are the technological developments likely to impact DOW cyber-related missions?

2. What are the indicators and warnings (I&W) of those technological developments likely to have “little impact” vs represent “major disruptions”?

3. What are the segments, roles, and related skills required for DOW’s unique cyber workforce?

4. What skills gaps in the DOW cyber workforce can be anticipated and what recommended courses of action can close these gaps?

Through the course of this study, more specific questions arose, and research methods were tailored to answer them, providing evidence upon which recommendations could be based. This report synthesizes the findings from these research efforts into 25 evidence-based, actional recommendations for the CIO. They are:

• Implement skills-based hiring across the DOW for its cyber workforce

• Assess aptitudes and personality traits that are unique to successful cyber professionals

• Increase recognition of cyber workforce excellence

• Reward cyber innovation by accepting reasonable risks

• Create a personnel support program that addresses unique challenges DOW cyber professionals face

• Ensure an adequate entry-level force to avoid a “diamond-shaped” workforce

• Emphasize the value of the national security mission, benefits, and clear career pathways to retain the DOW cyber workforce

• Continuously update the Defense Cyber Workforce Framework (DCWF)

• Work with the educational ecosystem to develop a curriculum that integrates specialized cyber skills, foundational STEM knowledge, and soft skills essential to effective performance for cyber professionals

• Use experiential learning as a means of integrating the full range of knowledge, skills, and abilities the DOW cyber workforce needs

• Train under duress to simulate the stressful conditions cyber operators often face

• Provide agentic AI education to entry, mid, and senior level DOW cyber professionals

• Work with secondary education to provide foundational cyber skills to the nation’s future cyber professionals

• Continue support to National Centers of Academic Excellence in Cybersecurity (NCAE-C) educational institutions

• Align commercial cyber certification providers and clinics with DCWF work roles

• Integrate training into operations

• Implement AI and digital literacy training programs for the entire DOW

• Partner with industry to support cyber technology development and create more opportunities for experiential learning

• Encourage broad-based cyber policy

• Partner with state and local governments to balance their needs with cyber infrastructure development and cyber education in K-12 and state-funded universities

• Encourage policies that support the growth and protection of cyber infrastructure

• Inform decision makers that just because the nation successfully guards its cyber infrastructure, adversarial threats will never go away and constant vigilance in growing the DOW cyber workforce is a necessity

• Prioritize the migration of DOW and the nation’s information systems to post-quantum cryptography (PQC)

• Prioritize advanced malware detection for the nation’s critical infrastructure

• Support the responsible advancement of agentic AI

Each of these is explained in this report along with the sources of evidence upon which they are based.

‍