iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Organizations are taking on more cybersecurity work than many teams believe they can handle—but there is no single, harmonized statistic measuring a worldwide gap between cyber risk and security resources. Separate findings from 2024 and 2025 point to shortages in staffing, skills and funding, while measuring different populations and conditions. The practical takeaway is to assess the capacity your own organization needs, rather than treating any one survey percentage as a universal benchmark.
What do the findings say about cybersecurity capacity?
The figures below describe different things: survey respondents’ experiences, an estimate of UK labor-market supply and demand, and a readiness index. They should not be averaged or read as if they measure the same global shortfall.
| Source and year | Finding | What it describes |
|---|---|---|
| World Economic Forum, Global Cybersecurity Outlook 2025 | The reported cyber skills gap rose 8% from 2024 to 2025; two in three organizations reported moderate-to-critical gaps, and 14% were confident they had the people and skills needed. | Organizations reporting skills capacity and confidence in the WEF report; these are not counts of vacant jobs. |
| ISACA, October 2024 | 61% said their organization’s cybersecurity team was understaffed, and 52% said its budget was underfunded. In the same survey, 41% reported more attacks than a year earlier and 58% thought an attack was likely in the coming year. | Surveyed European cybersecurity professionals, not all European organizations. Underfunding is respondents’ assessment, not an audited budget comparison. |
| ISC2, 2024 workforce study | 67% of respondents reported a staffing shortage and 90% reported skills gaps. ISC2 said lack of budget had replaced lack of qualified talent as the top cited cause of staffing shortages. | Respondents to ISC2’s workforce study; staffing and skills gaps are distinct reported conditions. |
| UK Department for Science, Innovation and Technology, 2025 | The UK cyber security workforce was estimated to need about 12,900 entrants in 2025 to meet demand and replace exits, against estimated annual inflows of about 9,100—a net annual shortfall of about 3,800. | A UK labor-market estimate based on the report’s assumptions, not a global vacancy count or survey of employers’ perceptions. |
| Deloitte-NASCIO, 2024 | 59% reported using third-party contractors to augment internal teams. | Surveyed U.S. state chief information security officers (CISOs); it does not establish that contractors are the right answer for every organization. |
| SANS, 2024 SOC survey | Staffing-related answers formed the largest barrier category overall; the survey also described problems with budget visibility. | Security operations center (SOC) respondents. The finding concerns reported barriers and does not quantify a universal funding gap. |
| Cisco, 2024 | 3% of surveyed organizations were classified as mature on Cisco’s readiness index, while 80% felt moderately to very confident in their defensive ability. | More than 8,000 private-sector leaders across 30 markets. Confidence is self-reported; index maturity is a separate measure of readiness. |
Are cybersecurity teams understaffed, or is the problem broader?
Headcount and skills are different constraints
A team can have too few people, or it can have people but lack particular capabilities, experience or coverage. ISC2’s 2024 respondents reported skills gaps more often than staffing shortages, illustrating why a headcount number alone may miss the problem. The WEF’s 2025 findings likewise focus on skills capacity and confidence, not only open positions.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
That distinction matters operationally. Hiring may add capacity, but it does not automatically provide every specialist skill, eliminate a backlog or establish that essential systems are protected. Training and better allocation of existing expertise can address some needs; other needs may require hiring or outside help.
#1 Best Overall
Budget availability and budget visibility are not the same
ISACA and ISC2 respondents reported budget pressure, while SANS described budget-visibility issues among SOCs. A team may be constrained by the amount it can spend, by difficulty connecting security costs to operational priorities, or by both. Perceived underfunding is not proof that a budget has been audited and found insufficient, and a larger budget alone does not demonstrate that an organization is mature or ready.
Why can’t organizations hire enough cybersecurity staff?
The evidence points to more than a shortage of candidates. ISC2 reported that lack of budget had become the leading cited cause of staffing shortages among its respondents, replacing lack of qualified talent. Deloitte-NASCIO also described budget constraints as contributing to understaffing and difficulties recruiting and retaining skilled workers. An employer may therefore struggle to fill a role because it cannot fund the position or compete to retain people, even when candidates exist.
Labor-market estimates add another perspective without answering every employer’s question. The UK government’s 2025 estimate compares projected workforce need with annual inflows and exits; its estimated shortfall is specific to the UK and to the assumptions used in that analysis. It should not be used as a count of unfilled jobs in other countries.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsMeanwhile, cyber responsibilities can grow as organizations add systems, vendors and interconnected services to protect. The WEF identifies supply-chain issues as a leading ecosystem cyber risk, but that is a risk finding separate from its workforce results. Taken together, the evidence suggests that the work can expand while hiring, training and funding decisions move more slowly—not that every organization faces the same cause or degree of pressure.
Rank #3
Does confidence show that an organization is prepared?
Not by itself. Cisco’s 2024 index found a sharp contrast between the share of surveyed leaders who felt confident and the share of organizations classified as mature. Those figures measure different things: a respondent’s view of defensive ability versus an index classification. The gap may indicate misplaced confidence, as Cisco suggested, but it does not prove that every confident organization is unprepared.
For an individual organization, confidence is most useful when checked against concrete evidence: whether critical services have assigned owners, whether known exposures are being addressed, whether monitoring and incident response have adequate coverage, and whether the team can demonstrate how controls work. A positive self-assessment cannot substitute for that operational picture.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How can a business strengthen security with limited resources?
Start by making the capacity gap specific. The following sequence is practical guidance, not a universally validated intervention or a promise that one option will close every gap.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →- Map what must be protected. Identify critical services, the systems and data that support them, key dependencies, and the exposures that could disrupt them. Prioritize based on business impact rather than treating every asset as equally urgent.
- Define the coverage and skills required. For each priority, identify the work that must happen—such as access management, vulnerability remediation, monitoring, incident response or supplier oversight—and the skills and coverage needed to perform it.
- Compare requirements with actual capacity. Check available staff time, relevant expertise, coverage hours, open work and budget. Distinguish a lack of people from a skills gap, an unclear budget, or work that has accumulated because priorities are not explicit.
- Choose how to address each gap. Options include hiring, training, simplifying or standardizing operations, reprioritizing work, and using vetted external specialists. Consider which tasks require internal ownership and which can safely be supported by a contractor.
- Set controls for any outside support. Define scope, access, accountability, reporting and escalation expectations before engaging contractors. External capacity can extend a team, but it does not remove the organization’s need to govern security decisions and verify that work is completed.
- Review capacity as conditions change. Revisit priorities when systems, dependencies, threats or staffing change, and check whether the chosen response is reducing the specific backlog or coverage gap identified.
Deloitte-NASCIO’s finding that many surveyed state CISOs use contractors shows that external augmentation is one option in practice, not that outsourcing is a substitute for internal skills. SANS’s findings also make budget visibility worth examining alongside the total budget: leaders need to understand which security work is funded and what that funding is expected to cover.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
