Security Workforce and Skills Gap Statistics Guide: Headcount, Shortages and Skills in Demand

Cyber security workforce numbers are quoted everywhere, yet the headline "gap" figures come from different methods that are rarely comparable and are often repeated years after they were published. This page brings together the latest workforce, shortage and skills statistics from the publishers that actually collect the data: the ISC2 Cybersecurity Workforce Study, the UK Department for Science, Innovation and Technology (DSIT) report Cyber security skills in the UK labour market, CyberSeek (a NICE, Lightcast and CompTIA initiative), ENISA's NIS Investments report and the US Bureau of Labor Statistics (BLS) Occupational Outlook Handbook. Every figure carries its publisher, report and edition in the same sentence or table row, and anything we could not trace to the publisher's own page is left out. Salary figures are taken only from official statistics (BLS). It is for security leaders, hiring managers, workforce planners and people building a career case. Last reviewed: October 2026.

Key takeaways

• The problem has shifted from headcount to skills. In the 2025 ISC2 Cybersecurity Workforce Study, 59% of respondents report critical or significant skills needs, up from 44% in 2024, and 95% report at least one skills need.
• Budgets, not just talent supply, limit hiring. ISC2 2025 finds 36% faced budget cuts and 39% hiring freezes, and 29% name lack of budget as a cause of skills shortages, almost as many as cannot find people with the skills (30%).
• Demand is still large in the US. CyberSeek counted 514,359 US cyber security job postings from May 2024 to April 2025, with a supply and demand ratio of 74%, and BLS projects 21% growth for information security analysts from 2025 to 2035.
• The UK shortfall is small in absolute terms, but skills gaps are widespread. DSIT's 2025 report puts the annual shortfall at about 3,800 people, yet 49% of UK businesses have a basic cyber skills gap and 30% an advanced one.
• AI and cloud lead the skills wish list. ISC2 2025 ranks AI (41%) and cloud security (36%) as the top skills needs, and CyberSeek reports about 10% of US cyber employers already cite AI as a requirement.

Headline statistics

Statistics by theme

Workforce size and the gap

• Global gap, last estimate: the 2024 ISC2 Cybersecurity Workforce Study estimated a gap of 4.8 million, up 19% year on year, equivalent to a theoretical workforce of 10.2 million if all staffing needs were met. ISC2 described the active workforce as flat that year, with North America down 2.7% and Europe down 0.7%, while Asia Pacific grew 3.8% and the Middle East and Africa 7.4%.
• Global gap, 2025: the 2025 ISC2 study does not publish a workforce or gap estimate. It reframes the problem around skills. Any page quoting a "2025 ISC2 gap" figure is either repeating the 2024 number or not citing ISC2.
• UK workforce: the DSIT report Cyber security skills in the UK labour market 2025 estimates about 143,000 people in UK cyber roles at the end of 2024, up about 5% from about 136,800.
• UK shortfall: DSIT 2025 estimates an annual shortfall of about 3,800 people, broadly stable after falling from 11,100 in the 2023 report to 3,500 in 2024.
• UK inflows: DSIT 2025 estimates about 6,000 new graduates, 600 new apprentices and 2,500 people from retraining or certification routes enter each year, plus about 2,600 moving across from aligned professions.
• US occupation size: the BLS Occupational Outlook Handbook counts 192,900 information security analyst jobs in 2025. This is one occupation code, not the whole cyber workforce, which is why CyberSeek's broader posting counts are much larger.

Demand and job postings

The two markets moved in opposite directions: US postings rose about 12% in the CyberSeek period while UK postings fell sharply in 2024. Read the UK fall alongside the economic pressure figures below; fewer advertisements do not mean the skills problem has been solved.

Skills gaps

• Severity: the 2025 ISC2 study reports 23% of respondents with critical skills needs and 36% with significant shortages, 59% combined. Only 5% report no current skills needs.
• Consequences: 88% of ISC2 2025 respondents experienced at least one cyber security consequence they attribute to a skills deficiency, and 69% more than one.
• Causes: ISC2 2025 respondents cite inability to find people with the skills (30%), no budget to hire (29%), retention difficulties (23%) and being able to hire but not pay for the skills (10%).
• UK organisations: DSIT 2025 finds a basic skills gap in 49% of businesses, 59% of charities and 14% of public sector organisations, and an advanced skills gap in 30% of businesses, 29% of charities and 21% of public sector organisations. Among cyber sector firms, 28% report technical skills gaps, up from 18% in 2021.
• EU organisations in NIS2 sectors: ENISA NIS Investments 2025 surveyed 1,080 organisations across all EU Member States and finds 76% struggle to attract cyber security professionals and 71% to retain them.

Skills in demand

• Non-technical skills: in ISC2 2025, hiring managers rank problem solving first (29%), while professionals rank communication first (59%); hiring managers put communication third (48%).
• AI adoption in teams: ISC2 2025 finds 28% have integrated AI tools into security work, 19% are testing and 22% evaluating. Of active users, 63% report a significant productivity gain. Only 17% hold an AI qualification, while 53% plan to obtain one.

Economic pressure on security teams

• Cuts and freezes: the 2025 ISC2 study reports budget cuts at 36% (37% in 2024), hiring freezes at 39%, promotion freezes at 34% and layoffs at 24%. Layoffs hit enterprises of 10,000 or more staff hardest (32%), against 18% at medium and 17% at small organisations.
• Outlook: 31% of ISC2 2025 respondents expect more cuts in the next 12 months and 26% expect more layoffs, up from 22%.
• Perceived risk: 72% of ISC2 2025 respondents agree cutting cyber security staff significantly increases breach risk.
• Budget share in the EU: ENISA NIS Investments 2025 finds cyber security receives 9% of IT budgets, with a median spend of EUR 1.5 million.

Retention, burnout and pathways

• Satisfaction: 68% of ISC2 2025 respondents are satisfied with their jobs, up 2 points, and 80% feel passion for their work.
• Burnout: 48% feel exhausted trying to keep up with threats and 47% often feel overwhelmed by workload; 32% say they are overworked because of shortages (ISC2 2025).
• Retention: 75% are likely to stay with their employer for 12 months and 78% plan to stay in cyber security for their career, but 28% have considered switching careers (ISC2 2025).
• Pathways: 56% of ISC2 2025 respondents came into cyber security primarily through IT; 10% cite education and 6% certifications as their primary route.
• Entry requirements, US: BLS lists a bachelor's degree as typical entry education for information security analysts, with less than five years' experience in a related occupation.

Diversity of the workforce

What the numbers mean for defenders

• Small versus large organisations: small firms in the DSIT data mostly lack basic skills, so managed services and clear runbooks for routine controls give the fastest return. Large enterprises face the highest layoff rate in ISC2 2025 (32%) and need retention plans for specialists and a documented skills matrix so cuts do not remove single points of knowledge.
• Hiring for skills, not certificates alone: only 6% of ISC2 2025 respondents entered mainly through certifications, yet certifications remain a common screen. Use them to verify knowledge, alongside practical assessment. See the Cybersecurity Certifications Guide and the ISC2 Certified in Cybersecurity (CC) Guide.
• Where identity fits: skills shortages show up quickly in identity work, where service accounts, API keys and machine credentials outnumber people and need owners. Thin teams should automate credential rotation and discovery first. See the Non-Human Identity and Secrets Statistics Guide and the Identity Certifications Guide.
• Hiring safely: remote hiring has opened the door to fraudulent candidates. Verify identity at offer and onboarding. See the Hiring Fraud and Candidate Identity Verification Guide.

How to act on these figures in a workforce plan:

1. Baseline: list every security work role and the people who cover it, using NICE Framework (NIST SP 800-181 Rev. 1) role names so gaps are comparable over time.
2. Prioritise: rank gaps by the risk they leave open, starting with incident response, cloud and identity, which map to the ISC2 top needs.
3. Pilot: run one internal rotation or apprenticeship cohort from IT operations and measure time to independent work.
4. Scale: fund the routes that worked, and buy managed services only for roles you cannot staff around the clock.
5. Review: recheck the plan each year when ISC2, DSIT and BLS publish new editions, and roll back any outsourcing that left knowledge gaps.

Metrics that show the workforce plan is working:

• Role coverage: share of defined security work roles with at least two trained people.
• Time to fill: median days from approved requisition to start date for security roles.
• Regretted attrition: security leavers the organisation wanted to keep, as a share of headcount over 12 months.
• Internal fill rate: share of security vacancies filled by internal moves or apprentices.
• Training completion: share of staff in specialised roles completing role-based training each year.
• Overtime and on-call load: hours per person per month, as an early burnout signal.

Common failure patterns when using workforce statistics

• Quoting a stale gap figure as current: the 4.8 million figure is from the 2024 ISC2 study; ISC2 did not publish a 2025 gap estimate.
• Comparing different populations: BLS counts one US occupation (192,900 jobs), CyberSeek counts online postings across many roles (514,359), and ISC2 surveys professionals. They are not the same thing.
• Reading falling postings as a solved shortage: UK postings fell 33% to 41% in 2024 while skills gaps stayed widespread; budget pressure explains part of the drop.
• Using advertised salaries from job boards: advertisements are a biased sample (DSIT notes most UK postings give no salary). Use official wage statistics such as BLS for pay benchmarks.
• Setting entry roles that need years of experience: 63% of UK core postings ask for 2 to 6 years, which shrinks the pool the data says is already short.

Methodology notes and caveats

• Self-selection: ISC2 samples professionals reachable through its channels, many of them members; results may over-represent certified staff.
• Posting data limits: CyberSeek and DSIT postings come from Lightcast scraping; duplicates, reposts and agency listings (33% of UK core postings) affect counts.
• Definitions differ: "basic skills gap" in DSIT means lacking confidence to carry out basic tasks; ISC2 "skills need" is self-reported by professionals. Do not merge them.
• Refresh cycle: ISC2 publishes late in the year, DSIT usually in early autumn, CyberSeek mid-year, BLS updates wages each spring and projections each autumn, and ENISA's NIS Investments report each December.

Practitioner checklist

• Quote every workforce figure with publisher, report name and edition year, and say what population it measures.
• Do not quote a 2025 ISC2 gap figure; use the 2024 estimate with its year, or the 2025 skills findings.
• Use BLS or national official statistics, not job board advertisements, for salary benchmarks.
• Map your security roles to NICE Framework work roles and keep a skills matrix.
• Prioritise AI, cloud, identity and incident response skills in training plans.
• Write entry-level roles with realistic experience requirements and an apprenticeship or rotation route.
• Measure role coverage, time to fill, regretted attrition and on-call load every quarter.
• Recheck these figures when each publisher releases its next edition.

Standards and references

• US Bureau of Labor Statistics: Occupational Outlook Handbook, Information Security Analysts
• UK DSIT: Cyber security skills in the UK labour market 2025
• ENISA: NIS Investments 2025 announcement
• CompTIA: CyberSeek workforce data release (NICE, Lightcast and CompTIA)
• ISC2: 2025 Cybersecurity Workforce Study
• ISC2: 2024 Cybersecurity Workforce Study findings
• NIST: Cybersecurity Framework 2.0
• NIST: SP 800-53 Rev. 5

Related NHI Mgmt Group resources: Cybersecurity Skills Gap and Hiring Guide · Cybersecurity Careers Guide · Cybersecurity Certifications Guide · Cybersecurity Statistics Guide · OT and ICS Security Statistics Guide