iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Creative hiring can help cybersecurity employers reach capable candidates they might miss with degree-only or years-of-experience requirements. But it is not a standalone fix: the shortage involves both staffing and specific skills, so employers also need realistic junior roles, supervised practice, training, and retention.
Why is there a cybersecurity job shortage?
“Shortage” can describe different problems: too few people on a team, difficulty finding a particular capability, or a workforce-gap estimate. Those are not interchangeable. ISC2’s 2025 workforce study focused on more specific skill and staffing needs and did not publish a headline estimate of the global workforce gap. Its researchers said that adding people alone may not resolve operational challenges when organizations cannot find or develop the skills they need. Read the 2025 ISC2 Cybersecurity Workforce Study.
The 2024 study used different measures: among 15,852 respondents surveyed with Forrester Research in April and May 2024, 67% perceived a staffing shortage and 90% reported skills gaps. ISC2 also estimated a global cybersecurity workforce of 5.5 million, up 0.1% year over year. These are 2024 estimates and respondent reports, not a count of unfilled jobs that should be carried forward as current. See ISC2’s 2024 study release.
Free tools Windows power users keep installed
One-click scans. No signup required.
The 2025 workforce findings come from an online survey of 16,029 cybersecurity practitioners and decision-makers in North America, Latin America, Asia-Pacific, and Europe, the Middle East and Africa, conducted in July and August. They describe respondents’ experiences, not a census of every employer or country.
#1 Best Overall
What capabilities are employers looking for?
In ISC2’s 2025 workforce study, hiring managers most often selected problem solving, collaboration, communication, willingness to learn, and strategic thinking. These are useful hiring signals when tied to observable work rather than vague personality labels.
| Skill selected by managers | Share selecting it | How to assess it in a role-relevant way |
|---|---|---|
| Problem solving | 29% | Ask how the candidate would investigate a defined alert or unfamiliar technical problem, and what evidence they would gather before escalating. |
| Collaboration | 24% | Use a scenario requiring coordination with an IT or business teammate; assess whether the candidate shares context and clarifies responsibilities. |
| Communication | 22% | Ask for a short explanation of a technical risk for a non-specialist audience, or a concise incident handoff. |
| Willingness to learn | 20% | Discuss how the candidate approached a new tool or unfamiliar task, including how they checked their understanding. |
| Strategic thinking | 16% | Ask how they would prioritize competing risks against stated business constraints, rather than rewarding abstract confidence. |
Percentages are ISC2’s 2025 survey results; respondents could select skills, so the figures do not add up to 100%. They show what surveyed managers valued, not a validated ranking of what makes someone successful in every cybersecurity role. See ISC2’s 2025 skills-focused report.
How do people enter cybersecurity without a conventional degree path?
ISC2’s 2025 workforce study found varied routes into the field. The largest reported path was IT experience, but respondents also entered through education in cybersecurity, professional experience outside IT, certifications, self-directed learning, military backgrounds, and internships or apprenticeships.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match| Reported entry route | Share of respondents |
|---|---|
| IT pathway | 56% |
| Cybersecurity education | 10% |
| Non-IT professional experience | 8% |
| Certifications | 6% |
| Self-directed learning | 4% |
| Military background | 3% |
| Internship or apprenticeship | 3% |
Among respondents aged 21–29, 38% entered through routes other than IT or cybersecurity education, while 23% entered through a cybersecurity degree. These are reported pathways, not proof that any route guarantees a job or is equally accessible in every location.
How can employers widen early-career hiring?
A separate ISC2 study surveyed 929 hiring managers in Canada, Germany, India, Japan, the U.K., and the U.S. All had entry- or junior-level cybersecurity staff and had recruited for such roles in the previous two years. Within that six-country sample, managers described several ways to look beyond a conventional degree-plus-experience profile.
Recognize relevant IT experience and entry-level credentials
In the hiring survey, 90% of managers said they would consider candidates with only previous IT work experience, and 89% would consider candidates with only an entry-level cybersecurity certification. “Would consider” is not the same as hiring, and a credential does not by itself demonstrate job readiness. Employers can use practical, role-related assessments to establish what a candidate can do and what training they would need.
Recruit through work-based and adjacent pathways
Managers named internships as a useful sourcing tool (55%) and apprenticeships (46%). They also reported finding candidates through programs outside computer science, IT, or cybersecurity. Work-based routes can give candidates a chance to demonstrate skills while allowing employers to assess performance in a supervised setting. Their effectiveness depends on program design and the organization’s capacity to mentor; the survey does not establish that either route will fill roles faster.
Make junior job descriptions genuinely junior
Expectations can undermine broader recruiting if an entry-level posting requires expertise that the job itself should develop. In ISC2’s 2025 hiring study, 18% of managers thought entry-level professionals could handle cloud-security tasks, while 46% said junior-level expertise was required. The gap in those responses is a warning to distinguish tasks a new hire can perform with guidance from work that needs an experienced practitioner.
Before posting, specify which skills are essential on day one, which can be learned, what supervision is available, and what success looks like after onboarding. Avoid using an entry-level label for a role that actually requires independent ownership of complex security work.
How should employers choose a hiring pathway?
Degree-first, experience-first, certification-supported, and work-based routes can each surface candidates, but the ISC2 surveys do not prove one is best in every organization. Compare them against the work and the support the employer can provide.
| Hiring route | What it can show | What to verify |
|---|---|---|
| Degree-first | Structured study and foundational knowledge relevant to the program. | Whether the candidate can apply the knowledge to the role’s actual tasks; a degree alone does not establish practical readiness. |
| Experience-first | Exposure to workplace systems, operational processes, or adjacent IT work. | How directly the experience maps to security tasks and what additional coaching is needed. |
| Certification-supported | Preparation against a defined body of knowledge or entry-level learning goals. | Practical judgment and hands-on ability; certification should not substitute for evaluating the work. |
| Internship or apprenticeship | Observed performance in a structured, work-based setting. | Whether the program includes meaningful tasks, supervision, feedback, and a path to continued development. |
For any route, assess demonstrated job-relevant skills, practical experience and supervision, time and cost to competence, realistic role expectations, post-hire development and retention capacity, and access for candidates with nontraditional backgrounds. The evidence supports considering these factors, not a universal formula.
Why hiring is only part of the response
In the 2025 workforce survey, 88% of respondents said their organizations had experienced at least one significant cybersecurity consequence in the preceding year because of skills shortages; 69% reported more than one. Those figures reflect respondents’ attribution of consequences to skills shortages, not an independent causal estimate.
Broadening the candidate pool will not resolve a skills shortage if new hires lack supervision, training, or a realistic role. Employers need to plan for development and retention alongside recruiting, and to avoid treating every capability as a prerequisite. Likewise, candidates should not read the survey findings as evidence that degrees no longer matter or that certifications guarantee employment.
Read ISC2’s 2025 Cybersecurity Hiring Trends study for the six-country hiring-manager findings.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
