Why the cybersecurity skills gap is growing - and how managed SOC and XDR can close it

webinar blog banner

Global, Mar 27, 2026

Across every industry, security leaders are grappling with an uncomfortable truth: the cybersecurity skills gap is widening, and its impact is now felt daily inside organisations. As cyber threats grow in volume and sophistication, many businesses are finding their internal teams overstretched, under-resourced, and unable to keep pace.

This was a central theme during our recent webinar with Cisco, where experts including Martie Moore, Artur Martins, and Albert Salazar discussed the challenges they see first hand, and how modern SOC services, strengthened by XDR capabilities, have become essential. Rather than simply adding more tools to an already overloaded security stack, a managed SOC gives organisations the expertise, capacity, and around-the-clock vigilance they can no longer sustain alone.  

The reality: A threat landscape outpacing available skills

According to Artur Martins, CISO and Cybersecurity Advisor at Logicalis, the fundamental issue is scale and complexity. Organisations now operate an ever-expanding ecosystem of tools, endpoints, cloud environments, and compliance obligations. Each new technology demands its own specialist knowledge—and those specialists are increasingly scarce.

Artur explained that customers 

“often have more technologies and products to take care of, but not enough people specialising in those technologies.” 

Hiring is difficult, he added, as specialists are “expensive and rare,” and organisations also need strategically minded staff who understand risk, governance, and compliance as a whole. Many companies simply cannot afford the breadth of expertise required.

The result? Existing security teams, or those with security responsibilities are overwhelmed by alerts, unable to maintain 24×7 vigilance, and struggling to turn tools into outcomes.

The consequences when tools outnumber people

Martie Moore, Lead for the Global Solutions COE at Logicalis, illustrated the issue with real customer stories.

In one case, a global organisation operated a highly skilled security operations (SecOps) team but only during business hours. 

“Threat actors don’t stick to business hours,” 

Martie noted. With no overnight monitoring, the organisation was breached. It wasn’t a lack of expertise that caused the incident. It was simply a lack of resources.

In another example, a customer had invested in many popular security tools available, from phishing defences to anomaly detection. Yet they were still breached through a phishing attack. The root cause? A misconfiguration. The tools were there, but without enough skilled staff to manage them, they weren’t delivering protection.

These stories reinforce a trend many CISOs recognise: technology alone cannot secure an organisation. You need the people and processes behind it.

Too many security providers  

Contributing to the issue of too many tools, is the effects of organisations relying on multiple third-party security service providers with no consistent approach. Artur Martins highlighted that while many third parties provide valuable point services, organisations frequently struggle with fragmented visibility, gaps in accountability, inconsistent processes, and delays between detection and action.  

Artur explained, “When an organisation has one provider managing tools, and another delivering alerts, and a third giving advice, no one has full ownership of the outcome. A modern SOC centralises responsibility - there’s one view, one team, and one accountable partner.”  

This unified model enables faster detection, faster containment, and far fewer errors caused by hand-offs between providers.

How 24x7 managed SOC services close the gap

This is where a 24×7 managed SOC becomes transformative. By augmenting internal resources with a global team of specialists, organisations gain continuous coverage, consistent governance, and rapid incident response - without needing to hire or train large teams in-house.

Albert Salazar, Director of GTM Readiness for Cisco, emphasised that smaller or public sector organisations often have 

“small teams with big problems,” and managed SOC services help them “stay one step ahead of constantly evolving threats.”

Artur added that one of the biggest benefits is peace of mind: customers gain confidence that “someone who knows what they’re doing is watching their environment and presenting problems with solutions.” Beyond detection, a mature SOC brings processes, playbooks, KPIs, and insights that help customers strengthen their security posture over time.

XDR enhancing the SOC teams

Extended Detection and Response (XDR) technology has dramatically boosted SOC efficiency by giving analysts unified visibility and the power to take direct action.

Artur explained that traditional SOCs can detect an incident remotely, but often have to ask the customer to carry out remediation tasks themselves - leaving them vulnerable outside business hours. With XDR, Logicalis analysts can isolate devices, block users, and contain threats instantly, without requiring customer intervention.

This is crucial at 3am, when delays could mean the difference between containment and widespread compromise.

Martie also highlighted how XDR’s built-in AI helps analysts work faster and learn on the job, reducing repetitive manual tasks and making it easier to develop talent internally. This not only improves outcomes - it helps retain staff by giving them meaningful, high value work.

Final advice to security leaders

Artur offered clear guidance for organisations struggling with the skills shortage: 
 

“Map your critical processes, tools, and needs - and then externalise operations. It’s the easiest, fastest way to gain the maturity required to manage modern threats.”

Martie noted that organisations are “not in this alone. There are trusted partners who can help you stay protected and sleep better at night.”

In a landscape defined by complexity, constant change, and escalating threats, one thing is clear: organisations don’t need to face the cybersecurity skills gap alone. With a trusted partner and a modern MXDR approach, they can gain the expertise, coverage, and confidence they need to stay secure.

Watch: Bridge the Cyber Skills Gap with SOC + MXDR >>

 

Related reading

 

Topic

Related Insights