The government has no shortage of cybersecurity challenges. Getting to complete zero trust architectures; AI security and containment; and post-quantum cryptography head the list.
What the government, or at least some agencies, lack is enough people trained in the skills to deal with these issues.
“It’s usually not technology that’s the problem,” said Lyron Andrews, author-fellow at Pluralsight. “It’s the gap between what people know and what they do.”
He spoke from experience in both the private sector and with federal civil servants across the government, including in the Defense Department. He’s working with the Cloud Security Alliance on its contract with the Cybersecurity and Infrastructure Security Agency to implement zero trust training.
In fact, Andrews said he urges companies to adopt the standards and practices, such as those published by the National Institute of Standards and Technology or CISA’s Zero Trust Maturity Model, which government agencies are under mandate to adopt.
“I have advised private organizations to follow some of the discipline that’s in the federal government,” he shared with Federal News Network for Cyber Leaders Exchange 2026.
Regardless of the domain of an organization, the knowledge gap is no mere academic question. It manifests itself directly in the availability of IT systems everyone in an agency depends on, Andrews said.
“Availability has a bunch of different children,” he said. “It can be really poor performance of an application that’s just been created. Availability could be how often that application is running at the rate that it should be. Or if it’s a network, is that network available?”
Shortcut to distinction
Agencies should think twice before embarking on a hiring program for new cybersecurity talent, Andrews advised.
“Cross-skilling existing talent beats waiting to hire new net talent,” he said, “because it’s hard to hire, especially in the federal government.”
Andrews, who has an education doctorate in adult development, said providing employees with what he called a ladder of ascent — that is, job and pay incentives to add new skills — will be less costly to the organization than adding new people. And it will create what he called “a more forward connection to their employees.”
“I want people to continue developing their capabilities in the organization,” Andrews added. “It’s going to be like a fertile ground for planting new skills into the organization that it doesn’t currently have.”
He realized the power in developing existing employees a few years ago at a large bank. The tech staff were experienced in Simple Object Access Protocol application programming interfaces. SOAP was great for traditional data centers, but the advent of commercial cloud computing required re-skilling in REST (representational state transfer) APIs.
“You had a whole generation of people who had done things one way for a long time,” he recalled. “Now, we’re asking them to shift, but you’re presenting it as a ladder of ascent.”
Andrews added that getting people to adopt new skills shouldn’t be a reactive or ad hoc process for an agency. “You need to build an environment where people already feel comfortable with shifting, moving, learning new skills and developing new capabilities,” he said.
Cross-skill, but verify
Administering courses or sending people to obtain certifications in cybersecurity (or any other) skills may not mean people have been meaningfully cross-skilled, Andrews pointed out. For some time now, the trend in government hiring and placing people has been moving to an emphasis on demonstrated skills, rather than diplomas or certificates of training completion.
“I take a course, I get asked maybe one or two questions in summary, and then I go to the next course,” Andrews said. “Most organizations know that that kind of reactive check doesn’t work. It’s really important to have a demonstrative way of showing that you now have this new capability.”
One way that organizations can gain certainty is by using what Andrews called work labs, so-called sandbox environments in which people can show real facility with a technology in which they’ve been trained.
“Somewhere within the learning spectrum, you have these interventions labs that are testing a person’s capability to interact with the system,” Andrews said.
He added, “Another part of it is just to be intentional about how learning is set up for the organization.” That means using multiple presentation media and combining instructor-led and self-guided sessions that ensure employees learn, do practice work in the lab and then reflect on what they’ve taken in.
And, Andrews said, “there should be an ample assessment at the conclusion of those three parts.”
There’s nothing wrong with issuing certificates per se, but only after you’re sure people have, in fact, gained the intended skill. Andrews pointed out that under Pluralsight’s training systems, for example in the DoD Cyber Workforce Framework, “the ‘do’ is in some kind of lab. The reflection is an assessment. And in the case of the DCWF, it’s also tied to a certificate of completing your learning.”
Agencies can enhance the effectiveness of learning and cross-skilling programs when they use a common taxonomy for cybersecurity work, Andrews said. He cited NIST’s National Initiative for Cybersecurity Education.
“The NICE framework provides a common language for cybersecurity work. It literally has a premade glossary of terms for things like, what is a security analyst and then what is an analyst’s function.”
Meanwhile, the DCWF and the Defense Department CIO office’s 8140 program provide alignment, approved qualification, accreditation and demonstrated performance standards for different cybersecurity situations, Andrews said.
He recommended that agency leaders responsible for cybersecurity and cyber training take three actions:
- Identify a specific and realistic failure or attack scenario.
- Identify the task and the people needed to handle it.
- Assess current performance through an exercise, so you can identify where things need to improve.
“Then, repeat the exercise and report what’s improved,” Andrews said. “Rinse and repeat if the organization really wants to understand if the learning is making the necessary impact.”
Discover more articles and videos now on our Cyber Leaders Exchange 2026 event page.
Copyright © 2026 Federal News Network. All rights reserved. This website is not intended for users located within the European Economic Area.