Workforce Report · Cybersecurity

The Cybersecurity Talent Gap.

Why critical security hires are harder to make now than ever before, the skills that matter most, and where the gap hurts most.

Published October 2026

95%

Of organizations have at least one skills gap

74%

Supply/demand ratio, US 2025, a record low

$4.8M

Avg. cost of a phishing breach

The shifting nature of the shortage

It's no longer about headcount. It's about the right skills.

The 2025 ISC2 Cybersecurity Workforce Study tells a more complex story than headcount alone. For the first time, ISC2 chose not to publish a global workforce gap figure, explaining that respondents had shifted their view: the need for critical skills within the workforce now outweighs the need to increase headcount. Headcount without capability is not security.

“The need for critical skills within the workforce is outweighing the need to increase headcount.” ISC2 2025 Cybersecurity Workforce Study

95%

Report at least one skills need, up 5% YoY

59%

Cite critical or significant skills needs, up from 44% in 2024

39%

Have implemented hiring freezes

88%

Have experienced a significant consequence of skills deficiency

The skills that matter most

ISC2 2025: top-ranked skills needs.

AI Security

41%

Cloud Security

36%

Risk Assessment

29%

Application Security

28%

GRC

27%

Security Engineering

27%

Penetration Testing

24%

Regional and financial impact

Where the gap hurts most.

United Kingdom: 637,000

DSIT's 2024 Cyber Skills report found 44% of UK businesses have a basic cybersecurity skills gap and 27% have gaps in advanced skills such as penetration testing. That proportion has not changed significantly across six years of data: these gaps are structural, not cyclical.

United States: 74%

CyberSeek's June 2025 data puts the US cybersecurity workforce supply-to-demand ratio at 74%, a measure of available workforce against employer demand rather than a simple count of workers per opening. It has declined over time, and remains one of the tightest talent markets in tech.

Sectors most exposed

Verizon 2025 DBIR: confirmed breaches by sector.

Manufacturing

1,607

Healthcare

1,542

Professional Services

1,147

Public Administration

946

Finance

927

The business case for acting now

The cost of inaction is measurable.

IBM's Cost of a Data Breach Report 2025 provides the financial context. The most frequent attack vector, phishing, averaged USD 4.8 million per breach. In the United States, average breach costs reached a record USD 10.22 million. Despite this, only 49% of organizations planned to invest in security improvements after a breach. The skills gap is real, it is growing, and it will be solved by a more nuanced approach to hiring and team expansion.

How C-Serv helps

✓Specialist sourcing across AI security, cloud security, GRC, and penetration testing.
✓Reach into passive talent who aren't on job boards, through a 13-year specialist network.
✓Permanent recruitment and contract staffing, scoped to how much you want us to carry.
✓Project and managed delivery when you need an embedded security pod built and run.
✓A rigorous, multi-layer vetting process. See how we work.
✓Coverage across 60+ countries, one accountable partner.

Sources: ISC2 2025 Cybersecurity Workforce Study; CyberSeek 2025; ISACA State of Cybersecurity 2024; DSIT UK Cyber Skills 2024; Verizon 2025 DBIR; IBM Cost of a Data Breach Report 2024.