The security skills shortage has reached a tipping point. According to the ISC2 Cybersecurity Workforce Study, 90% of organizations have skills gaps in their cybersecurity teams. Also, 64% say those gaps are a bigger threat than staffing shortages. The global cybersecurity workforce has flatlined at 5.5 million professionals against a 4.8 million gap in unfilled positions. On top of that, 88% of respondents have suffered at least one significant cybersecurity consequence because of skills deficits. The crisis is also changing shape: for the first time, professionals see skills development, ahead of headcount, as the main fix. This guide covers why the security skills shortage is worsening, which skills are scarcest and how CISOs and workforce planners should respond.
The Security Skills Shortage by the Numbers
The security skills shortage is an old problem, but its scale has grown fast. The ISC2 2024 Cybersecurity Workforce Study, based on a record 15,852 practitioners worldwide, found the active cybersecurity workforce at just 5.5 million, a 0.1% increase year over year. Meanwhile, the workforce gap widened 19% to 4.8 million, so the total workforce needed to meet demand now exceeds 10.2 million professionals.
Budget constraints have also overtaken talent scarcity as the main driver. For the first time, respondents named lack of budget, ahead of a shortage of qualified talent, as the top cause of staffing gaps. 33% of organizations lack the budget to staff their teams adequately, and 29% cannot afford professionals with the skills they need. On top of that, 25% reported cybersecurity layoffs in 2024, up 3% on the prior year, and 37% faced budget cuts, up 7%.
So 72% of respondents agree that cutting security staff significantly raises the risk of a breach. The skills shortage has become an organizational risk factor that affects breach likelihood, response times and compliance.
ISC2 draws a clear line between staffing shortages (not enough people) and skills gaps (people lacking the skills needed). 64% of respondents say skills gaps do more harm than staffing shortages, and in 2025, 95% reported at least one skill need, a 5% increase from 2024. Hiring more people alone will not fix that; organizations have to build the specific skills their teams lack.
Which Security Skills Are in Shortest Supply
However, the shortage is uneven across skill areas. Some categories face acute deficits that create outsized risk.
| Skill Area | % Citing as Top Gap | Hiring Manager Priority |
|---|---|---|
| AI and Machine Learning Security | 41% of teams lack this skill | ✗ Only 12% of hiring managers seek it |
| Cloud Computing Security | 36% of teams lack this skill | ◐ 19% of hiring managers seek it |
| Risk Assessment and Analysis | 29% of teams lack this skill | ◐ Moderate hiring manager priority |
| Zero Trust Implementation | Growing need | ◐ Emerging requirement |
| Digital Forensics | Persistent shortage | ◐ Specialized demand |
There is a real disconnect between the skills professionals think are in demand and the skills hiring managers prioritize. Professionals rate communication skills at 31% and cloud computing at 30%, while hiring managers rate them at 25% and 19%. Similarly, 23% of professionals believe AI skills are in demand, but only 12% of hiring managers are actively looking for them. That mismatch makes the shortage worse, because people train for skills employers are not hiring for.
The Real-World Consequences of the Security Skills Shortage
The security skills shortage has measurable, documented consequences for security posture, compliance and day-to-day operations.
The shortage is also wearing down morale. Job satisfaction among cybersecurity professionals fell to 66%, down 4% from the prior year. 48% feel exhausted from trying to keep up with threats and technologies, and 47% feel overwhelmed by their workload. Only 75% are likely to stay with their current employer for the next year, falling to 66% over two years. The result is a vicious cycle: overworked teams burn out, experienced people leave and those who stay face even more pressure.
Why Budget Is Now the Main Constraint
The most important finding in the ISC2 research is the move from talent scarcity to budget constraints as the main driver of the shortage, which changes how organizations should respond.
Meanwhile, managed security services are growing at 11.1%, the fastest rate in cybersecurity services, as organizations outsource what they cannot build internally. Closing the skills shortage increasingly means doing both: upskilling existing teams and using managed services for skills that cannot be developed in-house fast enough.
Five Priorities for Addressing the Security Skills Shortage
Based on the ISC2 research and workforce data, here are five priorities for CISOs and workforce planners addressing the security skills shortage:
- Prioritize skills development over headcount growth: 64% of respondents say skills gaps do more damage than staffing shortages, so put money into upskilling existing teams instead of only hiring. Set aside dedicated budget and working hours for AI, cloud security and zero trust training.
- Close the perception gap between professionals and hiring managers: Professionals and managers disagree on which skills are in demand, so align job requirements with what the organization actually needs. Cut unrealistic requirements that put qualified candidates off applying.
- Rebuild the entry-level pipeline: Nearly one-third of organizations have no entry-level cybersecurity staff, so create apprenticeship and rotation programs. You grow the next generation instead of competing for a shrinking pool of experienced people.
- Supplement with managed security services strategically: Internal expertise takes years to build while threats are immediate, so outsource monitoring, detection and response to managed providers. Use the time this buys to develop specialized internal skills.
- Address burnout before it accelerates attrition: With satisfaction down to 66% and 48% feeling exhausted, put workload management, recognition and growth opportunities in place. That keeps the experienced people who are hardest to replace.
In Brief
Key Takeaway The security skills shortage affects 90% of organizations, and 88% have suffered direct cybersecurity consequences from skills gaps. The workforce has flatlined at 5.5 million against a 4.8 million gap, and budget constraints now outrank talent scarcity as the main driver. The answer is moving from headcount to skills: upskill existing teams in AI, cloud and zero trust, and use managed services for skills that cannot be built internally fast enough.
Looking Ahead: Skills in an AI Era
The security skills shortage will change shape more than disappear, because AI is changing which skills matter most. AI will automate routine work such as alert triage while raising demand for people who can govern AI systems, interpret complex threats and make strategic security decisions. The 2025 ISC2 study also shows the industry moving from counting unfilled positions to measuring specific skills gaps and their business impact.
Organizations that invest in skills, rebuild entry-level pipelines and use managed services wisely will handle this transition well. Those relying only on competitive hiring, however, will struggle more. Automation and AI-assisted security operations will also stretch smaller teams further, which makes depth of skill more valuable than team size.
For CISOs and workforce planners, the shortage needs both quick tactical moves and sustained long-term investment. Organizations that treat cybersecurity skills as a strategic asset, investing in them as carefully as in technology, will build security teams that can keep up with an increasingly sophisticated threat landscape.
Our ServiceCybersecurity Services
Frequently Asked Questions
References
- 90% Skills Gaps, 4.8M Gap, 5.5M Workforce, Budget as Top Cause, Skills vs Hiring Perception: ISC2 — 2024 Cybersecurity Workforce Study
- 88% Consequences, 95% Skill Needs, 59% Critical Gaps, Skills Over Headcount Shift: ISC2 — 2025 Cybersecurity Workforce Study Press Release
- Skills vs Headcount Analysis, Budget Constraints, Burnout Data, Career Development: Network World — Cybersecurity Skills Matter More Than Headcount in an AI Era
Security Insights, Delivered.
Practical, vendor-neutral analysis of threats, tools, and architecture decisions.