Short of Talent, GCCs Turn to Simulating Cyberattacks to Prepare for the Worst
By Shalini Mondal ·
The cybersecurity ecosystem is in the grip of a talent shortage. The rapid pace of digital transformation and hostile entities increasingly leveraging AI for cyberattacks has left organisations scrambling for professionals equipped in cloud security, AI-driven threat detection, Zero Trust cybersecurity strategy, and incident response.
According to the ISC2 Cybersecurity Workforce Study 2025, while the global cybersecurity workforce currently stands at approximately 5.5 million professionals, organisations worldwide require nearly 10.3 million experts to adequately secure digital systems and infrastructure.
This creates an unprecedented gap of about 4.8 million unfilled cybersecurity roles.
Talking to AIM, Neeti Sharma, CEO of HRtech platform TeamLease Digital, sees a widening skills gap. “We estimate that there is a 30–50% gap between demand and supply, hence many GCCs (global capability centres) hiring cybersecurity professionals do feel a talent crunch.”
She adds that most of these GCCs are looking to hire candidates with expertise in cloud security, compliance frameworks like GDPR and SOC2, and enterprise-scale security ownership. “While we do get entry-level talent in these areas, there is a significant shortage of ready mid to senior professionals with these skills,” she observes
Cloud security architects, security architects, and threat intelligence experts face demand-supply gaps of 50–60%. Talent in AI security, identity and access management (IAM), and advanced incident response remains scarce due to the need for deep, hands-on expertise. While entry-level SOC hiring is relatively easier, experienced L2/L3 professionals are in short supply.
“According to our experience at Innefu Labs, Cyber Threat Intelligence Analyst is the most difficult role to fill,” Tarun Wig, Co-founder and CEO of the data analytics and information security solutions company, observes.
Candidates are expected to monitor threat actors, navigate the dark web, and deliver actionable, real-time intelligence. Such a combination is very difficult to find. Wig blames it on an education system unprepared for such advanced roles.
“Our educational system is failing to produce professionals who are skilled enough to deal with AI-based threats, zero-day attacks or attacks with national security levels,” he laments.
Organisations are now focusing on capability building. Simulation-driven training environments appear to be a promising solution, enabling GCCs to co-create upskilling programmes that prepare engineers for real-world cyber threats.
Deloitte’s Solution
Deloitte India, too, recently unveiled ConnectSafe, a cybersecurity facility in Bengaluru that offers a live environment that simulates real‑world cyber‑threat scenarios across automotive, medtech, industrial, and consumer ecosystems. Engineers train in simulated attack environments that resemble real-world cyber incidents—similar to war-gaming exercises—helping teams understand resilience strategies under live conditions.
The lab focuses on workforce readiness by collaborating with GCCs. The simulated environments enable organisations to test, validate, and strengthen security controls without disrupting live operations.
“By training in simulated attack scenarios that mirror live incidents, teams gain hands-on experience in resilience, response, and recovery—helping enterprises build a workforce ready for an increasingly complex digital risk landscape,” Gaurav Shukla, Partner and Leader – Cyber, Deloitte South Asia, tells AIM.
Rather than serving as a traditional cybersecurity centre, the facility applies a GCC-focused lens built around two primary objectives: product engineering simulation and enterprise cybersecurity co-innovation.
One of the core offerings is a digital twin capability that allows GCCs to simulate real-world deployment environments before launching products globally. This enables GCCs to test how products integrate into complex technical ecosystems—including infrastructure, cloud environments, and customer systems—across different regions.
The simulations also embed security and compliance considerations across the entire lifecycle.
“They can look at how security by design, privacy by design, resilience by design principles can be integrated… from the design stage… all the way up to production and post-production,” Shukla says.
A key advantage is regulatory testing. GCC teams can model compliance scenarios across markets such as GDPR requirements in Europe, India’s Digital Personal Data Protection Act (DPDPA), California Consumer Privacy Act (CCPA) in the US, and others. This allows engineering teams to identify required functionality or security changes before deployment.
Beyond product testing, many GCCs are also direct clients collaborating on internal cybersecurity modernisation.
“These GCCs… many of them we work together… we can co-innovate, co-create some of the use cases together which are going to be suitable to their environment,” Shukla believes.
For example, industrial and oil and gas GCCs use the facility to simulate cybersecurity frameworks for connected refineries and operational technology (OT) systems. As digital infrastructure connects upstream, midstream, and downstream operations, cybersecurity must be embedded across the entire operational chain.
Why IT-OT Convergence Makes This Urgent
The launch comes at a time when the boundary between IT systems and operational technology (OT) environments is disappearing.
Historically, OT systems prioritised uptime over cybersecurity. But digital transformation has changed that dynamic. While IT cybersecurity has evolved significantly over the years, rapid digital transformation has exposed previously isolated OT environments to new risks.
“The air-gap network… has been a myth for a very long time,” Shukla states.
As industrial systems connect to enterprise networks, cyber threats can move laterally into manufacturing plants, utilities, and infrastructure systems.
Even consumer devices now introduce risk vectors. Wearables, for instance, collect sensitive health and location data that could be manipulated or intercepted if unsecured—potentially impacting medical decisions or exposing personal information.
AI plays multiple roles within the facility, spanning both defensive and offensive scenarios. Key applications include detecting prompt injection and model manipulation risks in AI agents, automating cybersecurity playbooks through trained agents, running quality assurance reviews in near real-time, and simulating AI-driven cyberattacks to test resilience strategies.
AI agents can execute repetitive monitoring tasks, allowing cybersecurity professionals to focus on higher-level threat analysis and skill development.