The Cyber Skills Gap Just Changed Shape: What ISC2’s 2025 Study Really Says

The Number That Wasn’t There

For years, one figure defined the cybersecurity job market: the workforce gap. ISC2’s 2024 study put unfilled positions at roughly 4.8 million globally, a number cited endlessly to describe a field with more open seats than qualified people. So the most striking thing about the 2025 edition is what it left out. As ISC2’s own summary of the 2025 study explains, the organization “has not included an estimate of the cybersecurity workforce gap this year” — the first time it has withheld the figure.

The reason is a genuine change in what practitioners say constrains them. The study, built on responses from 16,029 cybersecurity professionals and decision-makers, found that respondents now prioritize the need for critical skills over the need for more people. In other words, hiring more bodies is no longer the industry’s self-identified problem; hiring the right capabilities is. That is a subtle but consequential reframe — it moves the conversation from a headcount deficit that a bigger pipeline could fix to a skills deficit that only targeted training and specialization can close.

The scale of the skills concern is what justifies the shift. In the 2025 study, 59% of respondents reported critical or significant skills needs, a sharp rise from 44% in 2024, and 95% reported at least one skills need — up five percentage points year-over-year. When nearly every practitioner in a survey of 16,029 respondents says their team is missing at least one critical skill, the binding constraint has clearly moved from quantity to quality.

AI Tops the List of What’s Missing

The specifics of the skills gap tell career-builders exactly where to aim. In the 2025 study, AI emerged as the single most-cited skills need at 41%, followed by cloud security at 36%. That ordering is itself a story: for years cloud security topped these surveys, and AI’s jump to first place reflects how fast the threat landscape — and the defensive toolset — has reorganized around machine learning, both as an attacker capability and a defender one.

The demand for AI-related security skills is not abstract. Security teams increasingly need people who can defend AI systems, evaluate AI-driven detection tools, and reason about the new attack surface that AI-assisted adversaries create. That is a materially different skill set from traditional network defense, and the 41% figure suggests most teams do not yet have it in-house. For someone deciding where to invest their own learning, the ISC2 data is close to a direct instruction: AI security first, cloud security a close second.

Why the Reframe Matters for Your Career

The move from “headcount gap” to “skills gap” changes the career calculus in a concrete way. A pure headcount shortage rewards anyone who can get certified and fill a seat; a skills shortage rewards depth in specific, contested capabilities. The practitioners in the ISC2 study are not saying their teams are fully staffed — they are saying that adding generalists no longer solves their problem, because the work that is going undone requires specialists. The risk of leaving those gaps open is well understood inside the field: 72% of respondents agreed that reducing cybersecurity personnel significantly increases the risk of a breach, a reminder that the skills the industry is short on are precisely the ones that prevent incidents.

There is also a demand-side nuance worth reading carefully. Budget pressure remained a real factor — cited by 36% of respondents, essentially flat from the prior year — which means the shift toward skills is happening even as economic constraints on hiring persist. Employers want specific capabilities and face budget limits, a combination that favours professionals who can demonstrate concrete, in-demand skills over those offering broad but generic experience. In a budget-constrained market, being the person who fills a named skills gap is far more defensible than being one more generalist.

What This Means for Building a Cybersecurity Career in 2026

1. Specialize toward AI security before it becomes table stakes

With AI the most-cited skills gap at 41%, deliberately building AI-security depth — defending machine-learning systems, evaluating AI detection tooling, understanding AI-assisted attacks — positions you against the field’s fastest-growing demand. Do it now, while the gap is wide and the specialists scarce, rather than after AI security becomes a baseline expectation for every security role.

2. Pair a contested skill with proof, because employers are buying capability not credentials

In a market where 59% of teams report critical or significant skills needs but budgets are flat, a certificate alone no longer differentiates you. Build demonstrable evidence — a portfolio, hands-on labs, documented incident work, contributions to security tooling — that shows you can close a specific gap. Employers constrained on budget will pay for proven capability far more readily than for potential.

3. Read the skills-not-headcount shift and stop competing as a generalist

The end of the headline gap number is a signal: the industry no longer believes it just needs more people. Position yourself as the answer to a named gap — AI security, cloud security, incident response — rather than as another applicant for a generic analyst role. The professionals who thrive in this market are the ones who can point to a specific, high-demand capability and prove they have it.

The Structural Lesson: Depth Beats Volume Now

The disappearance of ISC2’s workforce-gap number is more than a methodological footnote — it marks the moment the cybersecurity labour market stopped being primarily a numbers problem and became primarily a capabilities problem. For a decade, the dominant narrative was scarcity: not enough people, millions of empty seats, a pipeline that could not keep up. That narrative rewarded breadth and entry. The 2025 study’s reframe rewards something different: depth in the specific, contested skills — led by AI — that teams cannot fill even when they have the budget to hire. For students, career-changers and working professionals alike, the practical translation is consistent: chase the named gaps, prove the capability, and treat AI security as the defining specialization of the current cycle. The field still needs people badly — 72% of practitioners link thinner teams directly to higher breach risk — but it increasingly needs the right people, and knowing which skills those are is now the single most valuable piece of career intelligence a cybersecurity professional can hold.

Frequently Asked Questions

Sources & Further Reading

• 2025 ISC2 Cybersecurity Workforce Study — ISC2
• A Focus on Skills: The 2025 ISC2 Cybersecurity Workforce Study — ISC2
• Global Study Finds Organizations Facing Cybersecurity Gaps — GovTech
• Cybersecurity Skills Gap Statistics for 2025: Record 4.8M Roles Unfilled — DeepStrike