2014 CYBER INDUSTRY SURVEY

Transcription

1

2 Maryland s Cyber Industry Maryland s dynamic community of cybersecurity entrepreneurs, academia, federal agencies, investors, technologists and seasoned industry leaders makes it the nation s epicenter for cybersecurity and innovation. The industry is growing at a pace that often exceeds the qualified professionals to fill the number of jobs available. While many cybersecurity jobs are posted by large IT and defense contractors, there is an increase of companies on the commercial side that are also seeking qualified cyber warriors. To better understand what is occurring in Maryland s cyber industry, the Department of Business and Economic Development (DBED) worked with the Schaefer Center for Public Policy at the University of Baltimore to field its first-ever survey of Information Technology (IT) establishments to discover which were involved in cyber-related activities. The Schaefer Center contacted 8,296 establishments in Maryland involved in IT, making 24,248 phone calls, an average of 2.9 calls per establishment. Surveying occurred between March and July The survey asked about employment and sales growth, workforce needs, hiring of new workers, and research and development activities. In the end, DBED received data from a statistically-significant 303 firms. The survey had two major goals: First, to discover the current condition of the cybersecurity sector in Maryland, and second, to discover how many firms are involved in cybersecurity activities and to obtain general information on those activities. Ultimately, understanding how well cybersecurity firms are performing in their respective markets, what workforce issues they may be facing, and how they are expanding their markets will help DBED formulate approaches to and policies for the industry that can support its success in the future. The survey found that many cybersecurity establishments across the State have recently expanded sales and employment, and the majority believe their business will grow in the immediate future. However, these firms still have a great deal of reliance on Federal contracting, and many would like to see that reliance lessen. Survey Results DBED s cyber industry survey asked questions of IT firms involved in cyber-related activities firms in six different areas: Business Demographics Business Conditions Workforce Issues Entry-Level Jobs and Internships Customer Location and Industry Innovation and Research & Development Below are some of the most interesting and relevant findings from this inaugural survey. Involvement in Cyber-Related Activities DBED s survey of all IT establishments in the State found that 12.8 percent identified themselves as being involved in cyber-related activities, and that these firms employed a similar percentage of all IT workers. Since the total IT industry in Maryland was made up of 9,563 establishments employing 78,524 people in , this finding infers that the cyber industry in Maryland included an estimated 1,224 establishments employing 10,051 workers in that same year. The following survey results focus on those cyber firms and their activities. 1 Bureau of Labor Statistics,

3 Business Demographics Most of Maryland s cyber establishments were found to be small, locally-owned businesses, with almost half of respondents reporting that they employed under 10 employees. Over 92 percent reported being based in Maryland, and 71 percent reporting that they operate out of one location only. Most firms (84%) have been in existence for five years or more. Reported number of employees 4.3% % When asked to choose from a list of products or services that each establishment might provide, cybersecurity ranked first, followed by project consulting. Storage assessment was the product or service offered by the least number of establishments. products or services provided Rank Cybersecurity 1 Project consulting 2 Technical assessment 3 Network security 4 Software/application security 5 Storage assessment % % % 0-4 Only 20 percent of establishments reported that their firms export products or services outside the U.S. Only 9.5 percent of firms who do not export have any plans to do so within the next 12 months. 15.8% 5-9 Does your firm export? 0.7% Two-thirds of Maryland s cyber establishments only provide cyber services, but a large minority (28%) provide both services and products. Only 5 percent provide only cybersecurity-related products. 79.0% 20.3% Product- or service-based establishment Product-based Services-based 5.0% 66.7% Yes No Don t know Both 28.3% PERCENTAGE OF ESTABLISHMENTS 3

4 Almost half (43%) of Maryland s cyber establishments report that their firms sell the majority of their products to customers located outside Maryland. Are the majority of your firm s sales outside Maryland? 2.9% Business Conditions Almost 36 percent of surveyed establishments reported that they increased their employment over the last 12 months, with an additional 43 percent reporting stable employment. Almost 50 percent of establishments reported that their company s sales grew over that time period, and 46 percent felt that the overall size of the market for their product or service grew over the last year. 53.9% 43.2% Percent sales, employment and market changes, last 12 months Employment Company sales 35.8% 43.4% 47.7% 30.8% Yes No Don t know Over 62 percent of establishments reported that their location directly sold goods or services to the Federal government. Of these, 75 percent reported that the Federal government was their largest customer. Half of these government-reliant firms expressed interest in reducing their reliance on Federal purchasing. Is your firm a federal contractor? 1.1% Product market 45.7% 33.9% Increased No change Maryland s cyber establishments are extremely positive about future growth, with 84 percent forecasting growing sales over the next year. Employment growth is expected at three-quarters of all establishments surveyed. Percent expected changes, next 12 months 62.1% Employment Company sales Product market 75.1% 18.4% 83.8% 8.7% 81.7% 10.8% 36.8% Will increase No change expected Yes No Don t know, refused 4

5 Of the companies that expect to hire new employees, almost one-third reported that they plan to hire 10 or more employees over the next year. Over half expect to hire five or more. Expected employee hires, next 12 months, by establishments reporting hiring plans One to 2 jobs 3 to 4 jobs 5 to 9 jobs 10 or more jobs 18.4% 24.1% 26.4% 31.0% PERCENTAGE OF ESTABLISHMENTS Almost 60 percent of Maryland s cyber establishments expect to expand their operations over the next 12 months. Firms planning expansion, next 12 months 33.2% 3.6% 3.6% Plan to expand No expansion plans 59.6% Undecided Don t know Of firms with plans to expand, 63 percent expect to expand operations within Maryland. Interestingly, many of these establishments have plans to expand both within Maryland and in other U.S. states. A small percentage of these firms (6.6%) have plans to expand internationally. expansion plans percent Expand only in Maryland 43.0 Expand in MD and in other U.S. states 15.8 Expand in MD, other states and outside U.S. 4.2 Total plans to expand in Maryland 63.0 Expand only in other U.S. states 30.3 Expand in other states and outside U.S. 1.2 Expand outside U.S. only 1.2 Total plans to expand outside Maryland 32.7 Expansion plans undecided 4.2 Workforce The most common cyber-related job title at all surveyed firms was Systems Administrator, with 80 percent of respondents reporting that this title was used at their firm. Least common was Network Coordinator, with fewer than half of establishments reporting the existence of that position in their workplace. percent of position title firms Systems Administrator 79.6 Network Analyst 72.7 Systems Analyst 72.0 Software Engineer 69.9 Cybersecurity Engineer 67.2 Cyber Analyst 62.0 Database Administrator 60.0 Network Coordinator 45.6 More than half of Maryland s cyber establishments report that the rising cost of salaries is an issue for their companies. Almost half of respondents report that a lack of qualified workers to fill vacant positions is a major issue. It is easy to see how these top two areas of concern could be related, as labor shortages create an environment where talented and skilled workers can command higher salaries. 5

6 However, at the time that this survey was administered (mid-2014), only 35 percent of surveyed cyber establishments in Maryland had job openings in the State. Of these firms, 72 percent had fewer than five job openings, and most of these had only one or two openings available. Length of Labor Shortage Short term 29.7% Long term 22.0% Both Don t know 3.4% 44.9% Cost of salaries Quality of workers Training costs Security clearance costs Inadequate skillsets Retention of workers 6 Workforce issues of concern 46.2% 43.0% 39.4% 35.4% 27.4% 56.5% Survey respondents reported that their single strongest recruiting source for new employees was employee referrals. Second-strongest was online advertisements, followed by Maryland universities. Least important were certificate and training programs, and universities outside Maryland. Strongest recruiting source Employee referrals 32.8% Online ads 21.3% Maryland universities 17.4% Staffing companies Other sources 12.3% 10.7% Technical training placement programs 2.0% Universities outside MD MD cybersecurity certificate 2.0% 1.8% One quarter of survey respondents reported having a veteran hiring program that targets recent veterans. Of these establishments, 55 percent offer veterans preferential hiring Forty-three percent of survey respondents reported having problems recruiting workers over the past year, not surprising considering most firms did not hire new employees. Of firms that did hire, 50 percent reported problems with finding skilled workers. Two-thirds of respondents who suffered difficulty in recruiting reported that they had long-term shortages of skilled workers. Difficulties obtaining workers with Security Clearance 22.8% 1.8% Yes, had problems No problems 46.7% 28.7% Do not require Don t know, refused Most firms do not have problems recruiting workers with security clearance. Almost one-quarter report that they do not require security clearance for their workers. Excluding these firms shows that 38 percent of firms that would require an employee to have security clearance have trouble recruiting those workers. While the State of Maryland created a tax credit program to assist these companies in 2013 (the Security Clearances Costs Tax Incentive), only 15 percent of surveyed establishments are aware of its existence.

7 To help combat skills shortages, and to keep existing workers current, the majority of Maryland cybersecurity firms surveyed (54%) reported having internal training programs for their workers. Does firm have opening for recent graduates? 1.1% Entry-Level Jobs and Internships Nearly two-thirds of cyber establishments reported that entry level cybersecurity positions required a minimum of a Bachelor s degree. 70.0% 28.9% High school Associates Bachelors Masters Above masters None One to 2 years 3-4 years 5-10 years More than 10 yrs. Minimum education required for entry-level position 10.4% 1.2% 6.0% 19.7% 62.7% Minimum experience required for entry-level position 3.7% 9.4% 22.4% 29.0% 35.5% Although the survey question was asking about entry-level jobs, most respondents reported that they expected entry-level hires to have a fair amount of experience before they would be considered for a position. Fully 58 percent of establishments expected entry-level hires to have between one and four years of experience, while less than 10 percent would accept entry-level hires with no experience. Yes No Don t know Fewer than one-third of cyber establishments reported having openings for recent college graduates. Only 39 percent of firms with future hiring plans reported that they had openings for recent graduates. Over 58 percent of these firms had openings for only one or two graduates. Almost 50 percent of firms hiring recent graduates expect then to have some sort of certification prior to hiring. Of the six certifications inquired about in the survey, the Certified Information Systems Security Professional (CISSP) certification was by far the most desired, with almost 64 percent of establishments reporting that this certification is required for recent college graduates. percent of firms required certification requiring CISSP (Certified Information Systems Security Professional) 63.9 CompTIA Network CISM (Certified Information Security Manager 27.8 CAP (Certified Authorization Professional) 19.4 GIAC (Global Information Assurance Certification) 13.9 GSLC (Security Leadership Certification 8.3 7

8 Only about one-quarter of survey respondents offered cybersecurity internships at their establishments. Of these, about half had no interns on staff at the time of the survey. Of those establishments with interns on staff, more than half employed only one intern Customer Location and Industry Is access to customers or suppliers in Maryland important to business? 27.4% 1.1% technology firms. Not surprisingly, almost half of all respondents (46.4%) reported that being located near a Federal facility was somewhat important or extremely important to their business. Forty percent of respondents reported that being located near large firms like Northrop Grumman, Lockheed Martin, Sourcefire, or SAIC was valuable to their business. R&D Investment Over 45 percent of cyber establishments reported that their firm invested in research and development. Of these firms, virtually all had their own internal company research and development activities. Does firm invest in Research & Development? Yes 45.6% 71.5% No 53.3% Don t know 1.1 Yes No Don t know Almost three-quarters of all survey respondents reported that having access to their customers or suppliers located in Maryland is important to their business. Major industries of firm s customers Federal government Health care Technology Finance and insurance Energy Utilities Biotechnology Other 18.8% 15.8% 11.3% 6.4% 5.6% 4.1% 25.6% 54.1% The majority of respondents reported that the Federal Government was a major customer. Other major customers were the health care industry and PERCENTAGE OF ESTABLISHMENTS Sixty-three percent of firms reported R&D activities in collaboration with their business partners, while 20 percent reported technology transfer and licensing agreements with University or Federal laboratories and research institutions. Only 15 percent of Maryland cyber firms hold their own patents. Of those, almost half have applied for patents within the last 12 months. Thirty-six percent of cyber firms had introduced a new product or service within the last 12 months. Of these, 55 percent reported that this new product or service was new to one of their markets, meaning that these firms were introducing entirely new and innovative products. For more information about the cyber industry in Maryland contact [email protected]. or visit ChooseMaryland.org. 8