This is another interesting article about the job world in the cyber security realm. It talks about how there are not enough people who have the necessary skills for the jobs that are available. It means there are more jobs available for us to apply for. There are some pretty interesting statistics in the article as well.
https://www.csoonline.com/article/3237049/security/research-confirms-the-cybersecurity-skills-shortage-is-an-existential-threat.html
Think about this, if you are bad guy, all you need to concentrate is well learn your target. How about organization. What they are dealing with is way more than security. My assumption is bad guy is always smarter than us. But they are human too. They got limit energy and time. By leveraging existing resource, like training their own people and utilizing existing technology is more cost effective. Besides, security awareness works well in defending many attack. Complicate attack is launched by pros. It can only be deafened by well-trained pros.
Only the best can survive.