Headcount grew in 2025, but skills shortages remains an issue

The cybersecurity industry is wrestling with a thorny issue as we enter 2026: a significant skills shortage.

According to a recent ISC2 study, 63% of organizations reported having a slight or significant cybersecurity staff shortage at their organization, down from 68% in 2024. But while organizations are getting better at solving their headcount problems, they have issues with finding employees with the right expertise: More than half (59%) of surveyed professionals said they currently have a critical or significant skills need, up 44% YOY. (The study is based on a survey of 16,029 cybersecurity professionals in North America, Latin America, EMEA, and the Asia–Pacific region.)

Three in 10 organizations say they can’t find talent with the right skills, while another 29% blame not having a large enough budget to hire enough cybersecurity pros. Almost one-quarter (23%) of organizations say they have a retention problem with skilled talent.

Skill bill. Unsurprisingly, AI (41%) was cited as the top skill for security teams, followed by cloud computing security (36%) and risk assessment (29%).

Every action has a reaction. The industry skills shortage has a large impact on companies, with 88% of practitioners experiencing at least one consequence as a result. A little over one-quarter (26%) claimed processes and procedures have been overlooked because of it, while 25% said employees at their company had been given tasks too advanced for their training, and that they don’t have time or resources to supply that training.

Train and retain. Émile Cabot, a principal consultant at TriCon Elite Consulting, told IT Brew in an interview at Live! 360 Tech Con in Orlando that companies need to not only train employees, but focus on retaining them. He said talent will “jump ship” when they’re treated poorly and not rewarded for their efforts.

“You have to make sure and keep your people happy,” he said.