This is not unique to the SEC, most security groups at private companies face the same lack of skills and technologies. Cyber Security should not be under IT, since they have different, conflicting goals. IT's goal is to improve efficiency through technology. Security's job is to protect data...