iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Cybersecurity teams need enough people and the right capabilities to cover essential work. In ISC2’s 2025 survey, respondents more often reported critical skills needs than adequate staffing: 59% reported critical or significant skills needs, while 34% said their organization had the right level of cybersecurity staffing. That makes skills a priority to assess—not proof that headcount does not matter or that skills gaps alone cause security incidents.
Is the cybersecurity skills gap worse than the staffing shortage?
They are related but distinct problems. A staffing shortage means there are too few people to cover the work. A skills gap means the team lacks, or has too little of, a capability required to perform that work. A team can be fully staffed yet lack expertise in a critical area; a highly skilled team can still lack the capacity to handle its workload.
ISC2’s 2025 study surveyed 16,029 people responsible for cybersecurity at workplaces across North America, Latin America, Asia-Pacific, and Europe, the Middle East, and Africa. Responses were collected in July and August 2025. It found:
- 59% reported critical or significant cybersecurity skills needs, up from 44% in the 2024 study. Overall, 95% reported at least one skills need.
- 34% said their organization had the right level of cybersecurity staffing, four percentage points more than in 2024. Only 4% believed their organization had a staffing surplus.
The findings support treating capability as a central workforce concern, but they do not show that skills needs are universally more damaging than staffing shortages. The survey captures respondents’ reported conditions; it is not a census of organizations or a causal study. ISC2’s report says, “Addressing specific needs is no longer solved just by adding people but by investing in the professional development of existing team members.” That is ISC2’s interpretation of its findings, not evidence that training can replace hiring in every situation. Read ISC2’s 2025 Cybersecurity Workforce Study.
#1 Best Overall
ISC2 did not publish a workforce-gap estimate in its 2025 study. Its 2024 study estimated a global workforce gap of 4,763,963 people, but explicitly said that figure was not an estimate of current job openings. It described the difference between estimated organizational need and active professionals, using ISC2’s proprietary methodology. The 2024 study also found that 90% of respondents reported at least one skills gap on their teams, and 64% believed skills gaps could have a more significant negative impact than staffing shortages. Those are respondent views, not a measure of incident causation. See ISC2’s 2024 study and its methodology notes.
What cybersecurity skills are companies missing?
ISC2’s 2025 findings point to a mix of technical capabilities and skills that help people apply them across a team. The figures below are the shares of professionals or hiring managers who identified the listed areas; they are not a ranking of every employer’s needs.
Rank #2
Technical areas professionals identified
| Skill area | Share identifying it as a high-demand area |
|---|---|
| Artificial intelligence (AI) | 44% |
| Cloud security | 40% |
| Governance, risk, and compliance (GRC) | 30% |
| Zero trust implementation | 27% |
| Risk assessment | 26% |
Nontechnical skills hiring managers prioritized
| Skill | Share naming it among their top five desired skills |
|---|---|
| Problem-solving | 29% |
| Collaboration | 24% |
| Communication | 22% |
| Willingness to learn | 20% |
| Strategic thinking | 16% |
These findings argue against treating a skills inventory as a list of technical certifications or tool names. Security work also depends on people who can investigate problems, explain risk, coordinate with colleagues, and adapt as requirements change. Which capabilities matter most depends on the work your organization needs to perform.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
How can I assess my cybersecurity team’s skills gap?
Start with required work, not job titles. A title such as analyst or engineer does not, by itself, show which tasks someone can perform or where the team has backup coverage. CISA’s NICE Framework offers a common vocabulary for cybersecurity work and workers, organizing work into categories and roles and describing tasks alongside the knowledge and skills those tasks require. Explore the NICE Framework Resource Center.
- List the work that must be covered. Identify recurring and high-consequence tasks, such as assessing risk, securing cloud environments, responding to incidents, or meeting governance requirements. Use NICE categories, work roles, and task statements to describe the work consistently.
- Define the capability each task requires. For each task, identify the knowledge and skills needed and the level of proficiency your organization requires. Consider what must be done independently and what can be handled with supervision or external support.
- Compare requirements with demonstrated capability. Ask team members to describe relevant experience, then validate it through work samples, exercises, observed task performance, or other evidence appropriate to the task. Record who can do each task, at what level, and whether another person can provide backup.
- Rank gaps by risk and operational impact. Prioritize capabilities according to the business risk if the task is missed, how often the work occurs, and the consequences of delay or error. A rare but high-consequence task may deserve attention ahead of a frequent, lower-impact one.
- Choose a response and define how you will check progress. Set a target for what the person or team should be able to do, then identify how you will verify the capability in the work context—not just whether someone completed a course.
CISA’s NICCS training catalog can help locate training by location, delivery mode, specialty, or proficiency level. Search the NICCS training catalog.
How can we close a cybersecurity skills gap without hiring more people?
Use focused learning when the team has enough time and people to take on the work once they gain the capability. Pair instruction with opportunities to apply the skill in your organization’s environment; knowledge that cannot be used on relevant tasks may not resolve the operational gap.
ISC2 respondents reported several organizational responses to skills needs. These are reported practices, not evidence that any one approach is effective for every team.
| Reported response | Share of respondents |
|---|---|
| Time for professional development during work hours | 28% |
| Encouraging free vendor training | 25% |
| Internal-training budgets | 24% |
| Cross-training outside the established cyber team | 22% |
| Employee-led knowledge sharing | 21% |
To select among learning options, consider the gap being addressed, time to usable competence, opportunities to practice in context, direct costs and protected work time, and evidence that the learner can perform the task afterward. Training is one possible intervention; a certification alone does not establish that an individual or team can perform a particular task.
Cross-training and knowledge sharing can spread expertise and reduce dependence on a single person, but they still require time and suitable opportunities to practice. ISC2 respondents also reported using outsourcing and third-party providers. External support may be appropriate when specialized capability or additional capacity is needed, but it does not automatically build internal expertise.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.When is hiring or outside support still the right answer?
Training existing staff is not a substitute for adding capacity when the team cannot cover the workload, and it may not be the fastest way to fill a critical expertise gap. Consider recruiting, temporary support, or outsourcing when essential work remains uncovered, when the required capability cannot be developed in time, or when the team lacks enough people to apply a newly acquired skill. These options address different needs: hiring can add capacity and capability, training builds capability among current staff, and outside providers can supply capability or capacity depending on the arrangement.
Assess each option against the same task-level need: what work must be done, how soon it must be covered, whether the solution provides practice or continuity in your environment, and how you will verify the result. This keeps a workforce decision tied to operational coverage rather than headcount alone.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
