Cybersecurity skills need continual upkeep, but available evidence does not measure how quickly skills decay or show that they decay faster than organizations can build readiness. What it does show is that many practitioners report skills-related consequences, while time and training capacity make it difficult to stay current. The practical answer is to treat readiness as an ongoing, role-based capability—not a one-time hiring or training project.
What the evidence says—and what it doesn’t
ISC2’s 2025 workforce study collected responses from 16,029 people working in cybersecurity roles or functions across North America, Latin America, Asia Pacific, and Europe, the Middle East and Africa. ISC2 did not publish a workforce-gap estimate in that study, so older gap figures should not be presented as a 2025 finding. ISC2’s 2025 workforce study reports survey responses, not a universal measure of workforce readiness.
In that survey, 88% of respondents said their organizations had experienced at least one significant cybersecurity consequence in the prior year because of a skills shortage; 69% said they had experienced more than one. These are respondents’ reports, not a causal estimate for all organizations. Separately, the 2024 ISC2 study found that 90% of respondents reported one or more skills gaps on their teams and 59% said those gaps had substantially affected their ability to secure their organizations. Those are findings from a different year and survey; they should not be treated as a direct trend comparison. ISC2’s 2024 study
Neither set of findings measures a rate of skill decay or compares it with the speed at which organizations build readiness. The evidence supports a more bounded conclusion: practitioners report persistent capability needs and organizational consequences, and maintaining current skills is difficult for many of them.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Why keeping cybersecurity skills current is difficult
In ISC2’s 2025 study, 48% of respondents said they felt exhausted trying to stay current on the latest cybersecurity threats and emerging technologies. Another 28% said they lacked enough time to stay current, and 23% said they lacked adequate training opportunities. These survey results describe reported pressures; they do not quantify how quickly any particular skill becomes outdated. ISC2’s 2025 workforce study
Training capacity remains a practical constraint in large enterprises, too. In ISC2’s 2026 survey of 995 leaders involved in training decisions at organizations with at least 5,000 employees in Canada, Germany, India, Japan, the U.K., and the U.S., 47% said AI was the most pressing skill their organization was addressing or planning to address through training. Fifty-three percent cited time and scheduling as the primary training barrier. These figures apply to that survey’s large-enterprise respondents in those six countries, not to all employers or regions. ISC2’s 2026 enterprise training survey
Rank #2
- Matt-laminated and greaseproof pages ensure glare-free reading and long life
- The outside covers are made from a new rubberized material for better Handling and Grip
- All the Tool Holder Identification Sections now include a full INCH section along with a METRIC section
- Updated and Improved Index Searching
The figures point to a tension: organizations may recognize new capability needs, including AI-related ones, while employees and leaders have limited time to address them. A course completed once cannot by itself establish that people can perform changing work later; nor does course completion show whether a role’s most important tasks are covered.
Define readiness by the work people must do
The National Institute of Standards and Technology (NIST) NICE Framework offers a shared vocabulary for describing cybersecurity work and the knowledge and skills needed to perform it. NIST’s NICE Framework Resource Center puts it this way: “The NICE Framework establishes a common language that describes cybersecurity work and the knowledge and skills needed to complete that work.” It is used in career discovery, education and training, hiring, and workforce development. NIST NICE Framework Resource Center
Free tools Windows power users keep installed
One-click scans. No signup required.
For a readiness plan, start with the role’s tasks and expected outcomes, then identify the knowledge and skills needed to carry them out. NIST describes Task, Knowledge, and Skill (TKS) statements as building blocks; competency areas group related TKS statements into higher-level capability descriptions for cybersecurity domains. This makes role-based assessment and training more meaningful than counting courses or certificates alone. NIST IR 8355
That distinction matters when a job title hides different responsibilities. Two people called “security analyst” may need different development plans if one monitors cloud services while another investigates endpoint incidents. A useful plan connects learning to the work each person is expected to perform and gives the organization a way to check whether the capability is present.
Rank #4
Build a learning cycle, not a one-time training event
NIST SP 800-50 Rev. 1 provides a customizable life-cycle approach to cybersecurity and privacy learning programs. It includes suggested metrics and evaluation methods intended to help organizations improve and update programs as needs evolve. The publication is guidance, not evidence that training alone guarantees readiness or reduces incidents. NIST SP 800-50 Rev. 1
- Set role-specific objectives. Describe the work each audience must perform and map the required knowledge and skills. Use NICE terminology where it helps make expectations clear.
- Identify gaps with appropriate evidence. Compare the requirements with demonstrated knowledge and skill, not only with training attendance or credentials. Choose assessments that reflect the actual work.
- Make learning feasible during work. Schedule protected time and account for team coverage. The 2026 ISC2 enterprise survey’s finding that 53% of surveyed large-enterprise leaders cited time and scheduling as the primary training barrier makes capacity part of program design, not an afterthought.
- Match learning to the audience and gap. Combine broad awareness activities with role-based development as needed. NIST SP 800-50 Rev. 1 is designed to be tailored to diverse audiences rather than applied as a single identical program for everyone.
- Evaluate and update. Use program metrics and assessment results to decide whether learning objectives still fit the organization’s roles, systems, and needs. Revisit the cycle when work changes, such as when new tools or AI use introduce new requirements.
These steps are implementation ideas consistent with NIST’s guidance, not experimentally proven interventions. Their purpose is to make learning connected to work, assessable, and revisable instead of assuming that a completed course permanently closes a skills gap.
How to judge whether a readiness approach fits
When comparing internal training approaches or external programs, consider the same practical questions rather than relying on a single score. These are decision criteria, not a validated scoring instrument:
- Role and task relevance: Does the learning address work people are expected to perform?
- Demonstrated capability: Can the organization assess the knowledge and skills in a way that reflects the work, beyond counting attendance?
- Time and scheduling burden: Is learning time protected, and can teams participate without making the plan unrealistic?
- Adaptability: Can the program respond when systems, AI use, or threats change?
- Evaluation and revision: Are there measures and review points to show what needs improvement or updating?
NIST’s NICE materials support workforce capability planning and role-based training, while SP 800-50 Rev. 1 supports a learning-program life cycle. Neither framework is a substitute for an organization’s own assessment of its work, people, and risks. NIST NICE Framework Resource Center NIST SP 800-50 Rev. 1
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
