The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Cybersecurity teams need enough people and the right capabilities; one cannot always compensate for the other. In ISC2’s 2025 global survey, 59% of respondents reported critical or significant cybersecurity skills needs, up from 44% in 2024. Meanwhile, 34% said their organization had the right staffing level. The findings make skills a pressing concern alongside headcount—not proof that hiring does not matter or that skills gaps alone cause breaches.
Is the cybersecurity skills gap worse than the staffing shortage?
They are related problems, but not interchangeable. A staffing shortage means there are too few people to cover the work. A skills gap means the team lacks, or has too little of, a capability needed to do that work. A team can have enough employees on paper and still lack expertise in a critical area; it can also have capable specialists who are too few to provide coverage.
As an Amazon Associate I earn from qualifying purchases.
ISC2’s 2025 study suggests that respondents increasingly view skills needs as a priority. Alongside the 59% who described their needs as critical or significant, 95% reported at least one skills need. In the same survey, 34% said staffing was at the right level, four percentage points more than in 2024, while only 4% believed their organization had a staffing surplus. These measures describe different things: perceived skills needs and perceived staffing levels.
ISC2’s 2024 study found that 90% of respondents reported at least one skills gap on their teams, and 64% believed skills gaps could have a more significant negative impact than staffing shortages. Its estimated global workforce gap of 4,763,963 people was an estimate of the difference between workforce need and active professionals—not a count of current job openings. ISC2 did not publish a workforce-gap estimate in its 2025 study.
ISC2 characterized the 2025 findings this way: “Addressing specific needs is no longer solved just by adding people but by investing in the professional development of existing team members.” That is the organization’s interpretation of its survey, not causal proof that training will solve every shortage. Additional staff can still be necessary when workload, coverage, or expertise cannot be met through development or other support.
What cybersecurity skills are companies missing?
ISC2 respondents pointed to a mix of technical expertise and the abilities needed to apply it across a team. The percentages below are the shares of professionals who identified each area as high demand in the 2025 study; they are not a ranking of every organization’s specific needs.
Rank #2
- Matt-laminated and greaseproof pages ensure glare-free reading and long life
- The outside covers are made from a new rubberized material for better Handling and Grip
- All the Tool Holder Identification Sections now include a full INCH section along with a METRIC section
- Updated and Improved Index Searching
Technical and governance needs
- AI: 44%
- Cloud security: 40%
- Governance, risk and compliance (GRC): 30%
- Zero trust implementation: 27%
- Risk assessment: 26%
Skills hiring managers value
ISC2’s five most commonly named desired skills among hiring managers were all nontechnical:
- Problem-solving: 29%
- Collaboration: 24%
- Communication: 22%
- Willingness to learn: 20%
- Strategic thinking: 16%
These findings are a useful prompt, not a substitute for identifying what your own security work requires. A team supporting cloud infrastructure, for example, may need a different mix of capabilities from one focused on risk governance. Broad labels such as “security analyst” also do not show which tasks a person can perform independently.
How can I assess my cybersecurity team’s skills gap?
Start with the work the organization must perform, then compare required capabilities with what team members can demonstrate. CISA’s NICE Framework offers a common vocabulary for cybersecurity work and workers: it organizes work into categories and roles and describes tasks, knowledge and skills. Use it to structure an inventory, not as a checklist that every team must fill in completely.
- List critical security work. Identify recurring and high-consequence tasks, such as assessing risk, securing cloud systems, handling incidents, or meeting governance obligations.
- Map each task to a role and capability. Use the NICE Framework’s work roles and task, knowledge and skill statements to describe what successful performance requires.
- Record demonstrated capability. For each task, note who can perform it, what evidence supports that judgment, and whether they can work independently or need supervision. A job title or completed course alone does not establish task proficiency.
- Prioritize the gaps. Consider business risk, how often the task occurs, and the consequence if it is missed or delayed. A rare but high-impact task may deserve attention before a frequently performed, low-consequence one.
- Check capacity as well as capability. A qualified person may still be unavailable when needed because of workload, coverage requirements, or competing responsibilities. Record whether the issue is a missing skill, insufficient time or staffing, or both.
For training options, CISA’s NICCS catalog can be searched by location, delivery mode, specialty, or proficiency level. That can help locate courses after you have identified the role or skill to develop; choosing a course first risks solving the wrong problem.
Rank #4
How can we close a cybersecurity skills gap without hiring more people?
When the team has enough capacity but lacks a specific capability, targeted development may be a practical first response. ISC2 respondents reported several approaches in 2025:
- Protected time for professional development during work hours: 28%
- Encouraging free vendor training: 25%
- Budgets for internal training: 24%
- Cross-training outside the established cybersecurity team: 22%
- Employee-led knowledge sharing: 21%
These are survey responses about organizational practices, not evidence that any one approach is effective in every setting. The most useful choice depends on the task, how quickly competence is needed, and whether employees can practice in the organization’s environment.
Choose an intervention that matches the gap
- Focused course or vendor training: Can introduce a targeted skill, but should be paired with a chance to apply it to relevant work.
- Internal knowledge sharing: Lets experienced staff pass on context and methods; it needs time and a clear topic to avoid becoming informal knowledge transfer with no follow-through.
- Cross-training: Can broaden coverage beyond the established cyber team, provided participants receive practice and the additional duties do not create unmanageable workload.
- External support: Outsourcing or a third-party provider can help when specialist capability or immediate coverage is missing, though it does not automatically build in-house expertise.
- Hiring: Adds people and may add capability, but should be tied to the actual role or task gap. It is appropriate when development or external support cannot meet the need or workload.
Compare options on the gap they address, time to usable competence, access to practice in your own context, cost and protected work time, evidence of skill transfer or task performance, and whether the option adds capability, capacity, or both. Training and certification are not the same thing: the sources do not establish that earning a certification alone closes a team skills gap. Assess performance on the work the organization needs done.
What the survey can—and cannot—tell you
ISC2’s 2025 study surveyed 16,029 people responsible for cybersecurity at workplaces in North America, Latin America, Asia-Pacific, and Europe, the Middle East, and Africa. Data were collected in July and August 2025. The findings reflect respondents’ descriptions of their organizations, not a census of every employer or a direct measurement of each team’s technical capability.
The results support treating skills development as a serious workforce priority alongside staffing. They do not establish that skills deficits alone cause security incidents, that training replaces hiring, or that the same skills mix is right for every organization.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
