Jennifer Kleman

Survey reveals cost, complexity, talent shortages are leaving SMBs and public sector organizations dangerously under-protected

Tampa Bay, FL — September 25, 2025 — Cyber threats are escalating in scale and sophistication. Yet our defenses remain siloed, expensive, and out of reach for a wide range of organizations. The newly released 2025 CyberBay Report, based on insights from hundreds of IT and cybersecurity professionals, sounds the alarm and issues an urgent call to action for the private sector, educators, and cyber defenders to step forward and lead.

Download the 2025 CyberBay Report.

As artificial intelligence accelerates digital integration, the risks to and both private- and public-sector organizations are intensifying. Small- and medium-sized businesses (SMBs), which serve as the backbone of the economy, are left with tools they can’t afford, talent they can’t find, and systems that can’t keep up.

A System Under Siege

The CyberBay Report found that:

• 80.1% report a shortage of skilled professionals
• 81.3% cite organizational gaps in policy, behavior, and security culture
• 74.5% say undergraduate curricula are missing essential job-ready content
• 80.2% say cybersecurity tools are too expensive
• 71.9% find tools fragmented and poorly integrated
• 62.9% say professional training programs fall short of evolving demands

The results provide a strategic blueprint for filling gaps in the cybersecurity ecosystem. To protect our infrastructure, economy, and future, we must shift from isolated fixes to system-level transformation.

1. Democratize Cybersecurity Solutions

Affordability and usability are no longer optional. We must build scalable, AI-augmented defenses that even the smallest organizations can deploy.

2. Prioritize Cyber Defense as a Business Imperative

The private sector must lead—not with gated solutions, but with open collaboration, public-private partnerships, and investment in real-world resilience.

3. Elevate Education as a Strategic Asset

Cybersecurity education must evolve from theory-heavy programs to hands-on, threat-ready training that begins early and mirrors real-world challenges. Certification bodies, continuing education platforms, and vocational pipelines must align with the pace of escalating risk.

4. Activate a Culture of Readiness

Cybersecurity requires both the right toolset and the right mindset. Every organization needs policies, leadership buy-in, and cultural norms that reinforce vigilance. Readiness must replace awareness as the new standard.

CyberBay: The Movement Begins in Tampa

CyberBay, the Tampa-based cybersecurity collaborative, is proactively addressing the issue. By unifying private, public, and government sectors, CyberBay is democratizing cyber defense, prioritizing readiness over awareness, and training the next generation to meet the moment.

The inaugural CyberBay 2025 Summit will bring this mission to life. From October 13–15 in Tampa, FL, cybersecurity leaders, educators, technologists, and public sector champions will gather to build the future of cyber defense.

Register now at CyberBay.org and be part of the transformation.

Media Contacts:

Jennifer Kleman
Cyber Florida
jennifer437@cyberflorida.org

Christina Pandapas
Longview Strategies
cpandapas@longviewstrategies.com

printable version of press release

Enes “EJ” Bulut as a student in the SOCAP

From SOCAP to Security Engineer at TECO

At Cyber Florida, we believe hands-on experience is one of the most powerful tools for launching a successful cybersecurity career. Our Security Operations Center Apprenticeship Program (SOCAP) has helped many students build real-world skills while still in school. Enes “EJ” Bulut is a prime example.

Now, as a security engineer at the Cyber Fusion Center at TECO (Tampa Electric Company), Enes is a vital employee in keeping the organization’s systems secure. His work involves supporting and maintaining the tools used by TECO’s security analysts, including integrating new technologies, troubleshooting technical issues, and ensuring critical security systems are up to date.

But long before joining TECO, Enes was immersed in cybersecurity through SOCAP at the University of South Florida. The experience gave him more than just exposure—it gave him confidence.

“Working in SOCAP very early on in my time at USF, I had the opportunity to embrace the day-to-day routine of a security analyst,” he said. “From building cloud infrastructure in AWS to leading investigations that impacted USF’s security posture, I was learning how to apply my knowledge in real-world situations.”

Enes credits the SOCAP program with helping him understand both the technical and procedural sides of cybersecurity. He recalls managing AWS EC2 instances, responding to alerts, and taking the lead in incident response. Those experiences helped him hit the ground running after graduation.

Looking to the future, Enes sees himself growing further in the field of cloud security engineering, building on the foundations laid in the SOCAP program. With a strong technical base and a passion for learning, he’s on a clear path toward specialization.

And when he’s not keeping systems secure? You might just find him at the bowling alley as part of a bowling league.

We’re proud to celebrate Enes’s journey—and we can’t wait to see how far he’ll go!

More than 50 cybersecurity, technology, and computer science educators from 19 school districts across Florida came together for Cyber Florida’s OpK12 5th Annual Putts & PD event, a two-day professional development event focused on building cybersecurity education in K–12 schools.

Day one kicked off virtually with a robust webinar lineup featuring practical guidance on launching successful student internship programs, starting a CyberPatriot club, and accessing classroom funding through CAPE industry certifications. After a mid-day lunch break, participants tuned in for a live demonstration of Cyber Florida’s CyberHub virtual training range, explored free curriculum resources, and learned about offerings from CompTIA, Teaching Digital Natives, and Certiport.

Day two brought attendees together in person at Top Golf Tampa. AFCEA Central Florida announced a $20k mini-grant program for teachers in eligible districts. Prodigy Learning led a hands-on session showcasing the power of Minecraft Learning as a classroom tool for teaching coding and digital skills. Teach Cyber shared its valuable curriculum resources, and then the event concluded with lunch, networking, and complimentary golf, providing an energizing and memorable experience close to the professional development experience.

Sponsored by AFCEA Central Florida, the event reinforced Cyber Florida’s commitment to supporting and empowering educators as they prepare the next generation of cybersecurity professionals.

Tabletop Exercises Strengthen Election Infrastructure Security Across Florida

From Jacksonville to Panama City Beach, Cyber Florida’s FirstLine Summer 2025 “Road Trip” brought mission-critical cybersecurity training directly to election teams and public sector leaders across the state. Conducted in partnership with the Norwich University Applied Research Institutes (NUARI) and the Florida Division of Emergency Management (FDEM), this six-stop Tabletop Exercise (TTX) series was designed to simulate real-world election infrastructure incident scenarios and help strengthen interagency coordination, communication, and planning.

This program was funded through a Fortifying Florida grant provided by the Florida Division of Emergency Management and the Federal Emergency Management Agency (FEMA).

The TTX series, held in June and July 2025 in Jacksonville, Gainesville, Orlando, Sarasota, Panama City Beach, and Tallahassee, convened 129 participants from 40 counties. These no-cost events provided a safe, realistic environment for election officials, IT personnel, law enforcement, and emergency managers to test and refine their response to evolving threats against Florida’s election infrastructure.

“I attended this TTX as an intern to gain hands-on experience with real-world
cyber incidents. This was my first TTX, and I was looking to
gain new perspectives and also network.”

Building Readiness Through Realistic Scenarios

Each TTX presented participants with a simulated cyber or physical security incident involving election systems. The exercises required participants to respond under pressure, think across organizational boundaries, and prioritize coordinated actions and communication.

Attendees consistently praised the scenarios’ realism and relevance, with 100% of survey respondents affirming their applicability to real-world operations.

“The discussion between IT and office users during the exercises provided
a good exchange for each other’s perspectives.”

A Distinguished Turnout in Tallahassee

The final stop on the road trip in Tallahassee underscored the importance of the TTX series, drawing senior state leaders and cybersecurity experts, including:

• Kristen Pederson, Vice President, NUARI
• Melinda Miguel, Chief Inspector General for the State of Florida
• James Taylor, CEO, Florida Technology Council
• Yolanda Williams, Cybersecurity State Coordinator/Advisor, CISA
• Ashley Grover, Cyber Navigator Program Manager, Florida Department of State
• Travis Hart, President, Florida Supervisors of Elections
• David Crain, Senior Crime Intelligence Analyst Supervisor, Florida Department of Law Enforcement (FDLE)

Their presence demonstrated broad support for advancing cyber resilience in election infrastructure and affirmed the value of FirstLine’s targeted, tactical approach.

Key Takeaways: Preparedness Starts with Planning

Participants walked away from the TTXs with strengthened confidence, actionable insights, and renewed urgency around preparation. Common lessons included:

• The critical need for a written Incident Response Plan (IRP)
• The role of cross-agency communication during a crisis
• The importance of involving all stakeholders, not just IT

“1. Be prepared before an emergency happens. It is not a matter of if but of when.
2. Cybersecurity is not only for IT— the whole organization should be included.”

“Communication is key.”

“Go back and have discussions with my staff on where we currently stand regarding
preparation, readiness, and knowledge.”

The FirstLine Mission

FirstLine, Cyber Florida’s no-cost cybersecurity education and training program for Florida’s public sector, is designed to meet agencies where they are—literally. By delivering certified, scenario-based tabletop exercises across the state, FirstLine ensures that even the most resource-limited agencies can train, collaborate, and build resilience together.

The Summer 2025 TTX Road Trip exemplifies that mission in action: a practical, inclusive, and high-impact initiative supported by FEMA and FDEM through the Fortifying Florida program. As threats evolve, so will FirstLine, ensuring that Florida’s election infrastructure systems and public institutions remain a model of readiness and coordinated defense.

To learn more about FirstLine or request training for your agency, visit cyberflorida.org/training.

How One Apprentice Found His Footing in Offensive Security

When Yousef Blassy steps off the packed New York City subway each morning and walks into Google’s Manhattan offices, he’s stepping into a dream that started with curiosity, a willingness to take risks, and a foundational cybersecurity training program called SOCAP.

Today, Yousef works as an offensive security consultant at Google, placing him squarely on the front lines of one of the world’s most sophisticated tech environments. But a short time ago, he was a student in Cyber Florida’s SOCAP (Security Operations Center Apprentice Program), learning the ropes of a rapidly evolving field.

A Day in the Life at Google

As part of Google’s security consulting team, Yousef dives into complex client environments, actively hunting for vulnerabilities, testing system defenses, and identifying potential weak points before malicious actors do. When he’s not in the thick of an engagement, he’s contributing to team projects, conducting research, or sharpening his skills through continuous learning.

The work is fast-paced and mentally demanding, but Yousef is exactly where he wants to be. He credits SOCAP for helping him get there.

The SOCAP Experience: More Than Just Training

“Penetration test reports can be long and time-consuming,” he explained. “The technical writing I did in SOCAP—writing detailed tickets and documentation—directly prepared me for the type of communication required in my current role.”

Beyond writing skills, SOCAP provided a crucial launching pad for his red-teaming ambitions. While others might gravitate toward blue team roles, Yousef knew early on he was drawn to the offensive side of security. SOCAP didn’t just allow him to explore that interest; it actively supported it, even providing a voucher for the Practical Junior Penetration Tester (PJPT) certification.

Passing the PJPT wasn’t just a personal milestone; it proved to be a key differentiator during his interview process with Google.

From Apprentice to Consultant: Navigating the Transition

Still, the shift from a learning environment to full-time consulting wasn’t without its challenges. “The biggest adjustment,” Yousef says, “was the need for on-the-spot learning and problem-solving.”

As an apprentice, support was always close at hand. But in the world of security consulting, especially on solo engagements, the expectations are different. “There’s less handholding,” he explains. “You’re expected to deliver tangible results by the end of your engagement, even if the findings are minimal.”

That kind of independence requires technical chops, confidence, adaptability, and the mindset to treat every challenge as an opportunity to grow.

Advice for the Next Generation

Yousef doesn’t mince words when advising current SOCAP students: “Don’t be shy and actively seek out work you might feel unprepared for.”

He knows firsthand that some of the best learning happens outside your comfort zone. “It’s often all in your head. You are capable. And if you hit a wall, remember—whatever issue you’re facing, someone online has likely already solved it.”

Looking back, he wishes he had taken more initiative during the program. Whether it was participating in free Capture the Flag (CTF) competitions or attending local cybersecurity conferences, he sees now that those moments outside the classroom are just as vital to growth as the formal curriculum.

Looking Ahead

Yousef isn’t slowing down anytime soon. He sees his future rooted in cloud security, with a focus on becoming an increasingly skilled and impactful consultant. Next on his horizon? The Offensive Security Certified Professional (OSCP) certification is a notoriously challenging credential that he hopes to complete by the end of the year.

He’s also keen to give back. You can follow his journey or connect with him on LinkedIn, where he shares updates, thoughts, and resources for fellow cybersecurity professionals and students.

Beyond the Code

Of course, life at Google isn’t all about firewalls and exploits. Sometimes, it’s about grabbing a $1.50 slice of pizza to get through a long shift. And sometimes, it’s about a deeper lesson that has nothing to do with security tools or certifications.

For Yousef, that unexpected insight came in the form of spiritual clarity: “Have trust in God’s plan, for He is the best of planners.”

Yousef’s story is proof that cybersecurity careers aren’t born—they’re built, step by step, with curiosity, hard work, and the courage to take on what you think you’re not ready for. From SOCAP to Google, he’s forged a path that many aspire to—and he’s just getting started.