2590: Closing the Cyber Skills Gap: A Conversation with Roy Zur of ThriveDX

[00:00:01] The question, and we get from a lot of businesses, what happens later on? Meaning, okay, we hired a person, we have someone for a year or two, now we want to continue to enhance their skills in cybersecurity. That was Roy Zur, CEO of a company called ThriveDX Enterprise, a global leader in cybersecurity training and workforce development.

[00:00:23] And I invited him on here today to take a deep dive into the world of cybersecurity, that cybersecurity skill shortage that we read about every day. Because it isn't just about thwarting cyber attacks, it's about building a robust, diverse cybersecurity workforce for the future. And this comes at a time where there are a lot of job displacement, but the cybersecurity field has 0% unemployment.

[00:00:50] And as a result, ThriveDX is rolling out an unprecedented cybersecurity apprenticeship program that aims to not only fill those glaring skills gap in the industry, but also seeking to enhance the workforce diversity, bring people into the industry from a diverse backgrounds and people outside of the tech industry. Let's say you've got somebody working in your warehouse at the minute that may be on the verge of losing their job. Give that person an opportunity to learn cybersecurity.

[00:01:18] And that can be achieved through a range of strategic nonprofit partnership and help you bring your people up to speed and solve some pretty big problems. So if you're keen to explore how the current economic climate and cybersecurity skills shortage is actually providing opportunities for re-skilling or how businesses can unlock risk-free onboard cybersecurity talent, then stick around. We've got a lot to unpack today.

[00:01:44] So buckle up and hold on tight because I'm going to beam your ears all the way to Tel Aviv Startup Nation, where today's guest is waiting to join me. So a massive warm welcome to the show. Can you tell everyone listening a little about who you are and what you do? Sure. First, great to be here. My name is Roy. I am the CEO of ThriveDX Enterprise. I'm an entrepreneur, been in the cybersecurity and education space in the last 20 years.

[00:02:12] And ThriveDX is actually a merge of several entities. One of them, a company I founded called Cybent and another company called HackerU. And together, these two companies merged about two years ago. We acquired some other companies. And today, what we do is we are solving the talent shortage and skills gap in cybersecurity by developing solutions to re-skilling and up-skilling the workforce in cyber and other related fields.

[00:02:42] And you mentioned a few big topics. I mean, with the current economic climate all around the world, the cybersecurity skills gap, the fact that there is a 0% unemployment rate within the industry is big news as well. And with the global economy facing challenges, I was reading that you mentioned that cybersecurity offers a unique opportunity for candidates to re-skill or up-skill. So can you discuss how this sector remains resilient and what it means for the broader workforce?

[00:03:10] Right. Some would say that cybersecurity is a recession-proof industry. And we see the numbers. We see the fact that cybersecurity remains with 0% unemployment or 100% employment. And actually, the demand for cybersecurity professionals and cybersecurity workforce is actually bigger than the supply currently. We see globally there are about 3.5 million unfilled jobs in cybersecurity.

[00:03:36] In the UK alone, the gap between the demand for security professionals to the supply is about 60,000 people. For example, that is based on the ISC Square latest reports of the summary of 2022, but we see it in other reports. In the United States, for example, almost 800,000 people are missing in the industry based on the latest White House report.

[00:03:59] So this is a big problem for both the industry and the government because you need security professionals to protect the country, protect the economy. But it's a big opportunity for the individuals because individuals can actually re-skill themselves into cybersecurity. And when we say re-skill is actually there are today programs that can take someone from zero, what we call zero to hero or from novice to advanced in cybersecurity.

[00:04:28] People with no background and with no formal education can re-skill themselves in a matter of three to six months into cybersecurity position. And this is one of the main things DriveDX is doing globally. And we've been training and re-skilling about 60,000 people into security positions in the last several years. And more than 90% of them are now employed in security positions or other related technology positions.

[00:04:56] And I think that re-skilling movement is so important and such an exciting topic because at the moment we are talking about AI displacing certain traditional job roles or certain industries. And there is a huge opportunity there. And I think for somebody outside of IT, for example, they probably just assume that, hey, that's just for techies. I'm not great at math. I'm not great at this. There's no way I can enter that. And then there's also people from underprivileged backgrounds. And I think there's such an opportunity.

[00:05:23] And I think it's needed as well to bring diversity of thought into the industry to solve some of these complex problems. And there will be a lot of people listening in whatever industry, whatever job role that they're in, they will have transferable skills. The other stuff can be treated, can be taught. And I was reading before you came on, one of the things that you guys stated is that ThriveDX, you offer this different kind of training model in cybersecurity. So I've got to ask, what sets your approach apart from, let's say, other training providers in this space? Yeah.

[00:05:52] First, I totally agree with you that people actually specifically in cybersecurity is a different field than other, I would say, tech positions like top developers or data analysts. And one of the reasons, if you think about cybersecurity at the essence of the position, it's almost like law enforcement of the digital world, right? It's almost like protecting, whether it's protecting a company or protecting the government or protecting others. And actually people that are coming from non-tech backgrounds could bring a lot of value into that.

[00:06:22] Think about veterans, people who worked in the military, people who worked as a police officer, people who worked in other industries where they actually had different perspectives or people who were analysts in a different position. So this is actually something that we see can bring a lot of value to a security position. And what's unique with ThriveDX is a lot of our professionals, including myself, came from a military background in the beginning.

[00:06:50] Now, I spent about 10 years in the Israeli Cyber Intelligence Agency. And one of the challenges we had is that the Israeli Cyber Intelligence Agency hires people when they are 18. That's how the mandatory compulsory service in Israel works, meaning that they don't really have the background or the experience to work in cybersecurity. They just finished high school.

[00:07:13] And the thing is how you actually focus on aptitude and attitude of a potential, the potential of the candidate to work in cybersecurity versus just focusing on the hard skills that currently exist. And what ThriveDX is doing is actually identify, running this assessment to identify the right people that may not even be aware of the fact that they are the right people.

[00:07:38] And then offering them this reskilling path that takes someone really in a few months and turn them into a security professional. And that the unique part is exactly this, is that we are not looking necessarily for people with any relevant, quote unquote relevant skills. But it doesn't have to be I'm doing anything techy. Maybe I'm not techy at all. But we will be able to identify the potential and then to provide a very hands-on training, the same way we were doing in the military.

[00:08:05] Because also in the military, if we need to train someone from zero to hero, as we like to call it there, we don't really have more than three to six months. Their entire mandatory service is two to three years. So we cannot send them to traditional education. We have to create this vocational accelerated learning experience. And this is what ThriveDX is doing.

[00:08:28] So your new program ultimately offers companies a risk-free way to bring in cybersecurity talent and reskill current employees, which is so important right now. So can you elaborate on how it all works and maybe share a use case or story on the impact that you expect it to have for them? Yeah, so our program has been running for many years, training tens of thousands of people for the industry, for companies. Some of them, these are actually employees that the company send to us. And we actually do internal mobility programs.

[00:08:58] So you can take someone from the warehouse and send them to a security position. And many of them are actually reskilling people from diverse backgrounds, different backgrounds, to have more inclusivity within the organization. And the unique program that we recently launched is in partnership with a nonprofit called Apprenti. And the model there is that Apprenti, with Apprenti as a nonprofit working in the United States mostly for many, many years.

[00:09:25] And they received a federal grant, a government grant in the United States. And that grant actually allows them and us as their partners to do this entire process of identifying people with the right aptitude, assessing them, training them, and placing them as apprentices for a significantly reduced cost for the enterprise customer.

[00:09:49] Meaning that enterprise or any other businesses or government agencies can now partner with us and Apprenti and solve their internal talent shortage with our programs with almost no significant cost or no training cost, just some aspects around the employment and some registration fees going with Apprenti.

[00:10:09] But in general, this program that typically would cost almost $20,000 per person actually is being reduced significantly to cost almost nothing for the employer other than the employment costs and the registration fees. And it's that workplace diversity piece that really excites me because, as you said there, your program aims to enhance workplace diversity in the cybersecurity sector by partnering with nonprofits to help achieve this.

[00:10:38] But I've got to ask, what kind of metrics are you using to measure this success? The success of all of our programs, not just in the Apprenti, it's pretty easy to measure because the most important thing is employability. Meaning that if we really want to see that our program works, we want to see that people got a job and develop this job into a career.

[00:11:00] Meaning they didn't get a job and lose it in a few months, but they got a job and they stayed in the job or in the field of cybersecurity for a longer period of time. So while we are, of course, we are measuring customer user satisfaction, learner satisfaction, customer satisfaction, we are measuring all of this. But the most important KPI, the most important thing we are identifying is our employment rates.

[00:11:24] And I'm very proud that ThriveDX has about 93%, 93% employment rates of those students that are using our career services. So which almost, it kind of like talks about the same 0% unemployment with our graduates. And this is something that we always focus on when we focus on the success criteria for ThriveDX.

[00:11:49] And for any business leader listening, maybe they're outside of the tech industry or maybe somehow they're unfamiliar with just how big this cybersecurity skills gap is. Can you, from the conversations that you're having with all your clients, how big a deal is it right now? And how is your apprenticeship program helping to fill that void? Because you must get to hear a lot of very similar stories out there. Yeah. So when we talk to businesses, cybersecurity and cyber attacks are growing really fast.

[00:12:16] And as the world become more digital and actually with the AI, trending AI tools, actually that creates more risks, if any, to cyber attacks. But when we talk to CISOs, chief information security officers, CIOs, CEOs, we hear a lot about the fact that while this cybersecurity challenge is technological or sounds technological, actually the human factor is one of the biggest challenges.

[00:12:43] From the fact that about 95% of all security incidents involve the human factor or human error that's coming from an IBM research to the fact that companies are struggling to fill in jobs. And the numbers, and we see it year over year, the number as of early 2023, the latest workforce, global workforce research by ISC Square shows about 3.5 million unfilled jobs in cybersecurity.

[00:13:13] But what it means is that companies are struggling to fill in positions. And because there are not enough people coming into the industry, they have to, in a way, steal from one another. It's about, it's a competition. So a lot of, they are circling the same people. But in order to solve 3.5 million unfilled jobs, you can't just count on the people that are already in the industry. You must bring new people in. And the Appretti program, that's exactly it.

[00:13:40] Because the problem is that a lot of organizations would say, sure, we want to hire people with entry-level positions. We need to hire them, but we must have three, four, five years of experience. Now, people who are three, four, five years of experience are already in the limited number, are part of the limited number of existing professionals. So if you have 3.5 million unfilled positions, this will not help you. You must create ways, we like to say, open the gates.

[00:14:09] Open the gates of your company to say, yes, I am willing to hire someone qualified, with the right skills, with the right aptitude, with the right attitude, from different backgrounds. Maybe not the traditional background that I'm used to. And to find out that this will both solve my problem in the short term, but I'll find out that person that I just hired as an apprentice will actually stay with me for a longer time.

[00:14:34] There is some more loyalty from the people who get this opportunity from the organization to stay with the organization for a longer time. And that's why we see that with the apprentice program, about 90% of the people that went into an apprenticeship of one year stay in the organization later. So it's not a one-year apprenticeship and then you move on to your next opportunity. You typically stay within the organization, and that's why it's a long-term sustainable solution for the company.

[00:15:05] And you do use the term risk-free, which will be incredibly compelling for businesses and anybody listening. And a lot of the problems that you've highlighted today, I suspect they will be business leaders nodding their head in agreement. It's a very real problem. So can you explain how companies can engage with this program without incurring risks, especially for those listening that might be a little bit skeptical, thinking, yeah, this is great, but where's the catch? Right. Yeah.

[00:15:28] The risks, one risk could be, well, I don't want to hire someone who's underqualified, even if I want to have diversity in the organization, but I don't want people that are underqualified. So one aspect to solve this is that we, DriveDX, are working with the employer and Apprenti to find the right candidates for the organization. And we actually have a pool of hundreds of thousands of candidates. So we are actually searching within a very large pool.

[00:15:55] DriveDX alone is getting 300,000 reach-outs from individuals on an annual basis that want to reskill into cybersecurity. Apprenti database includes tens of thousands of people. So the first component of the risk-free is, will I get an underqualified person? And the answer is no, we can source people correctly for your specific needs from these databases. Then the second question is, oh, okay, so they have the right background, but what about the training?

[00:16:24] So the training that we will provide to these candidates is actually the highest quality training, the same thing that we do with the University of Chicago or University of Michigan, Miami, Wisconsin, all the universities that we work with. The same level of bootcamp that we run there, we run with this apprenticeship program. So they will get this three-month full-time or six-month part-time. It's a very intense program, more than 400 hours of content, hundreds of labs, hands-on activities, training support.

[00:16:54] So when they get into the organization, they are not just having the right aptitude and attitude, but already have the hard skills. So that's another risk-free component. And the third is about the price. Typically, these programs cost almost $20,000 for an individual if you run them, if you pay them out of pocket in the United States in one of our centers.

[00:17:14] But because of this grant, we actually, the grant of the federal grants coming from a grant fee is actually covering the training cost. Meaning it's almost like bringing, not almost, actually bringing a full grant to the learner. So the learner is not paying for the training and the company is not paying for the training. The company is getting into some engagement with accredited. And the engagements say that they will hire that person following the training as an apprentice.

[00:17:44] So there are some costs related to the registration, but they are significantly lower than any recruitment cost or any training cost that the company will have. So we're talking about a few thousands of dollars, something like that. Like not something significant and you can actually hire dozens of people if you need from this program. So that's why we call it risk-free. So if you compare it to all other alternatives or hiring someone, recruiting someone, this is probably the most risk-free you can find among the other solutions.

[00:18:14] And the questions I've got to ask on behalf of everyone listening all over the world is what markets do you serve? And also, do you only deal with businesses if there's an individual listening that wanted to explore how they might be able to upskill themselves? Do you work with those two? So our biggest market is the United States. Specifically, the Apprenti program is also focusing on U.S. individuals. The employer, by the way, could be anywhere in the world. But specifically, the Apprenti is it's a government grant, a federal grant in the U.S. This is mostly for U.S. individuals.

[00:18:43] But in addition to the U.S., we actually have partnerships around the world, this including Canada, UK, Germany, France, India, Singapore, Australia, and other locations. And typically what we do in these countries is that we have a local partner. The local partner is like the operator, and they use the ThriveDX platform and programs.

[00:19:06] And yes, individuals can reach out either to ThriveDX directly or to one of our partners, local partners that we have in different countries, and they can apply to our programs. And in different places, there are programs or there are different financing models of the programs. Some programs can be fully covered, the cost, by a government grant or another grant. Others have other financing models.

[00:19:29] So it really depends on a case-by-case basis, but we definitely serve many individuals, and we train tens of thousands of people on an annual basis. And we are at that time of the year, of course, thinking about a new year, 2024. A lot of people are going to be creating their goals, ready for the new year. A lot of businesses doing the same as well. And this ThriveDX continues its mission to help reskill and upskill the global cybersecurity workforce.

[00:19:55] Are there any other future initiatives or programs that we might be able to anticipate for me or to further address the challenges in this sector? I'm pretty sure there might not be too much you can share, but is there anything you can leave us with? Yeah, I would say one thing. So ThriveDX's main focus was always what we like to call the zero to one, like bringing people into the industry, the reskilling. The question, and we get from a lot of businesses, what happens later on?

[00:20:19] Meaning, okay, we hired a person, we have someone for a year or two, now we want to continue to enhance their skills in cybersecurity. And what we are launching, we already have it in a beta version, but we are launching full scale early next year. It's going to be taking the more upskilling advanced training programs for people who are already working in the industry.

[00:20:42] So beyond just the reskilling into the industry, we'll have multiple programs around network security, cloud security, threat intelligence, pen testing, and other important elements that will be able to take professionals and in a short period of time, enhance their skills and keep them relevant within the industry. So our approach is to be this end-to-end human factor or human capital security solution.

[00:21:08] And that's what we are doing right now, but we plan to expand this in 2024. And a question I'd love to ask is to learn something from you as well. Who teaches the teacher? Because there's a real pressure on everyone to be in a state of continuous learning now, no matter who you are. So where or how do you self-educate to keep up to speed with everything? It's a great question. I really want to be honest about this.

[00:21:30] I've been to one of the latest cybersecurity conferences, both at Black Hat, Cyber Def Con, and other events, RSA. And you know what? And I'm being very candid here. I found myself at some point meeting with so many companies and going into different technology showcases. And even I, at some point, felt that I am not, I have this gap.

[00:21:54] I felt that even me that runs this training, cyber training, I felt I, even myself, I can't find all the answers and I lose track of what's going on in the industry. And to avoid this, and as an individual and as a company, one of the things that I decided to do, we decided as an organization to do, is something that we call last mile training. And last mile training is something that we are now integrating into our programs.

[00:22:20] And the basic of the concept of this is that we go out to the industry, to these emerging technology companies that develop the next generation of cybersecurity. And we actually learn from them. We go to these tech companies and we ask the tech companies, teach us about your technology, teach us about your capabilities. And then we build short training around these technologies and add them back to our programs.

[00:22:44] And that actually keeps us up to date with everything that's going on in the industry because it's a very challenging industry and it's very hard to keep up to date with everything that's going on. Personally, I struggle with that. So definitely everyone else struggles with that. So we are trying to keep up to date by addressing what's going on, the pulse of the industry at every given point. Love that. It's so refreshing to hear someone answer that so candidly. So thank you.

[00:23:11] And for anyone listening wanting to find out more information, we've covered a lot of ground today. Probably opened up a few light bulb moments around the world as we're talking here. But where would you point everyone listening that just wants to find out more information? Maybe start a conversation with you guys too. Sure, yeah. They can reach out to our website, ThriveTheX.com. They can also visit our LinkedIn page, Facebook page, Instagram. Even for the individuals, we have TikTok page. And I'm happy always that people can reach out directly to me on LinkedIn. Roy Zuer.

[00:23:41] I try to approve everyone to have conversations on LinkedIn. So feel free to reach out. And we can definitely work together in solving the talent shortage and skills gap in cybersecurity. And that is the very reason I invited you on the podcast today. It seems like every day I open my newsfeed and there's another article about the cybersecurity skills shortage. So it's great to hear how you're tackling this, especially with this cybersecurity apprenticeship program.

[00:24:04] It's offering companies a risk-free way to bring in cybersecurity talent and also re-skill current employees. Such an important topic right now. And a big thank you for taking the time to sit down and sharing your vision for doing just that. Thank you. I appreciate the time. A huge thank you to Roy for coming on today and talking about the value of hiring individuals from non-traditional tech backgrounds and bringing them into the industry to tackle this significant skills gap in the cybersecurity industry.

[00:24:34] And it's a landscape that is often misunderstood and underestimated. And for me, Roy really showed that the challenges in cybersecurity offer not just risks, but huge opportunities for businesses and individuals alike, notably through this innovative apprenticeship program that we're talking about. But before we sign off today, it's worth noting that initiatives like the Thrive DX Cybersecurity Apprenticeship Program are taking a multi-dimensional approach to problem solving.

[00:25:03] They're not merely filling roles. They're creating ecosystems that are diverse, inclusive and sustainable in the long run. So if you are a business leader seeking a strategic, cost-effective way to bolster your cybersecurity defenses, maybe this is something you want to think about exploring. But this is just me thinking out loud. You've heard from me. You've heard from today's guest. How are you overcoming the cybersecurity skill shortage? Are you still going to market?

[00:25:30] I'm paying way over the odds to try and secure new talent that might only leave in a few months. Or are you interested in exploring how you can take an existing employee from outside of the technical department, someone with a bit of ambition, someone that wants to learn and maybe pivot to a different career and enter the tech industry? How about harnessing that enthusiasm and allowing them to bring their transferable skills into the industry? It's such a huge opportunity and something I'm very passionate about.

[00:26:00] But I'd love to hear how you're doing just this. This is just one story today and I want to get more stories like this on here. So email me, techblogwriteroutlook.com, Twitter, LinkedIn, Instagram, just at Neil C. Hughes. Let's keep this conversation going. But that's it today. But that's it for today. So thank you for listening as always. Please join me again tomorrow. We've got another topic lined up for you already. But thank you for listening. And until next time, don't be a stranger. Thank you.