Cybersecurity's Real Shortage Isn't People. It's Skills.

For years, the industry's favorite statistic was the size of the global cybersecurity workforce gap. Every conference opened with it, usually next to a stock photo of a hooded hacker typing in the dark.

That story has changed. The 2026 SANS | GIAC Cybersecurity Workforce Research Report, based on 947 security and talent leaders, found that 60% of organizations now name skills gaps as their primary workforce challenge, compared with 40% who name headcount shortages. A year earlier, the difference was just four points. Now it's twenty.

ISC2's 2025 Cybersecurity Workforce Study, which surveyed more than 16,000 professionals, reached the same conclusion from a different angle. It stopped publishing its famous workforce gap estimate altogether. Instead, it reported that 95% of respondents had at least one skills gap on their team, and 59% called those gaps critical or significant, up from 44% the year before.

Two major studies, one message: hiring more bodies won't fix a skills problem.

Here's the number that should get every executive's attention. In the SANS research, 27% of organizations said they had experienced an actual security breach as a direct result of workforce capability gaps.

More than one in four. That's not a training budget line item. That's an incident report.

And the people expected to close those gaps are under pressure. SANS found 61% of organizations reported increased stress on their security teams over the past two years, while only 24% offered well-defined, clearly communicated cybersecurity career paths. Stressed teams with no visible future tend to become smaller teams.

SANS found that 74% of organizations say AI is already affecting the size and structure of their cybersecurity teams. Yet only 16% reported actual headcount reductions. AI isn't replacing security teams; it's changing what they need to know.

ISC2's respondents agreed. AI and cloud security topped the list of urgent skill needs, and 73% believed AI will create more specialized security skills, not fewer. Every AI tool a company adopts is a new system to secure, a new data flow to protect and a new way for things to go sideways.

If your plan is "just hire more," the money may not be there. In ISC2's study, reports of budget cuts dipped to 36% and layoffs to 24%, each down one point from 2024. That's stabilizing, not recovering. A third of respondents said they lacked the resources to staff adequately, and 29% said they had no funds for hiring at all.

Long-term demand still looks strong. The BLS lists information security analysts among occupations projected to grow at least 19% from 2024 to 2034. The work is growing. The budgets just aren't growing as fast.

Write job descriptions around problems, not acronyms. "Secure our move to multi-cloud identity management" attracts different people than a wall of six certifications. Certifications matter, but they're evidence, not the goal.

Test what candidates can do. SANS found employers most often validate skills through certifications (64%) and skills assessments (49%), well ahead of academic credentials (17%). A realistic incident scenario in the interview tells you more than any resume. Our AI interview question generator builds role-specific questions in minutes.

Hire adjacent and train. A strong network, cloud or systems engineer with curiosity can grow into a cloud security role faster than you'll find a unicorn. Budget for the training up front.

Bring in specialists for projects. An AI security review, cloud migration or compliance push often needs deep expertise for months, not years. Contract talent fits that shape and, done right, leaves knowledge behind.

Build visible career paths. With only about a quarter of organizations offering clear paths, a simple, honest ladder is a recruiting advantage.

Chasing the perfect candidate for six months. Meanwhile, the gap stays open and the team burns out.

Treating training as optional. If the skills you need didn't exist three years ago, nobody has ten years of experience in them.

Ignoring retention. Every departing security engineer takes context with them: how systems are wired, which alerts are noise and where the old exceptions live. Retention is a security control.

Skipping identity checks on remote hires. Fake candidates target exactly these roles. (We covered how to spot them in our post on fake job candidates and deepfake interviews.)

The data points in one direction: cloud and AI security. Hands-on labs, cloud platform experience and documented projects matter more than ever. Show what you've built and secured, not just what you've studied. Browse open IT roles or share your resume.

Is the cybersecurity skills gap bigger than the talent shortage?

Yes. In SANS's 2026 research, 60% of organizations named skills gaps as their top workforce challenge, compared with 40% for headcount shortages.

Which cybersecurity skills are most in demand in 2026?

AI and cloud security top the list in ISC2's research.

Do skills gaps cause security breaches?

SANS found 27% of organizations experienced a breach directly tied to workforce capability gaps.

Ready to close the skills gap instead of just filling seats? Our IT staffing team places vetted security and cloud professionals on contract and permanent terms, with an average time to fill of 9 days. See how we work.