Attracting and retaining IT security professionals may be the No. 1 staffing challenge states face, but the numbers alone unveiled in a recent National Association of State Chief Information Officers survey don't tell the whole story.