Many organizations report that cybersecurity demands are outpacing the people, skills, and funding available to meet them. The evidence points to a real capacity problem, but not to one universal “cybersecurity gap” figure: the findings come from different surveys, regions, and kinds of measurement.
What the reported gap looks like
Recent findings describe several related pressures: teams without enough staff, workers whose skills do not match the work, budgets respondents consider insufficient, and labor markets that may not supply enough new professionals. These measures should be read side by side, not added together or treated as a single global statistic.
As an Amazon Associate I earn from qualifying purchases.
| Source and population | Reported finding | What it measures |
|---|---|---|
| World Economic Forum (WEF), Global Cybersecurity Outlook 2025; organizations covered by the report | The cyber skills gap rose 8% from 2024 to 2025. Two in three organizations reported moderate-to-critical skills gaps, and 14% were confident they had the people and skills needed at that time. | Organizational reports and confidence about skills capacity; not a count of vacant jobs. |
| ISACA, October 2024; surveyed European cybersecurity professionals | 61% said their organization’s team was understaffed, and 52% said its budget was underfunded. 41% reported more attacks than a year earlier; 58% thought an attack likely in the coming year. | Respondents’ views of staffing, budgets, and threat experience or expectations—not audited budgets or a census of European organizations. |
| ISC2, 2024 workforce study; respondents | 67% reported a staffing shortage, and 90% reported skills gaps. ISC2 said “lack of budget” had replaced “lack of qualified talent” as the top cited cause of staffing shortages. | Respondent-reported shortages and reasons, not a labor-market vacancy estimate. |
| UK Department for Science, Innovation and Technology, 2025; UK cyber security workforce estimate | The workforce was estimated to need about 12,900 entrants in 2025 to meet demand and replace people leaving, against annual inflows estimated at about 9,100: a net annual shortfall of about 3,800. | A UK labor-market estimate based on the report’s assumptions, not a global headcount or vacancy total. |
| Deloitte-NASCIO, 2024; surveyed U.S. state CISOs | 59% reported using third-party contractors to augment internal teams. | A capacity response reported by state government security leaders; not evidence that contractors are right for every organization. |
| Cisco, 2024; more than 8,000 private-sector leaders in 30 markets | 3% of surveyed organizations were classified as mature on Cisco’s readiness index, while 80% felt moderately to very confident in their defensive ability. | An index classification alongside self-reported confidence; neither number alone is a direct measure of every organization’s security. |
The figures are not directly comparable: they differ in geography, respondents, methods, and what they measure. WEF’s discussion of supply-chain issues as a leading ecosystem cyber risk concerns another dimension of cyber risk, not its workforce findings.
Recommended Free Tools
Are cybersecurity teams understaffed?
Many surveyed professionals and security leaders say they are. ISACA’s European respondents reported understaffing, and ISC2’s 2024 respondents also reported staffing shortages. Those are meaningful signals, but they do not establish that every organization—or every country—has the same headcount problem.
#1 Best Overall
Headcount is only part of the capacity question. A team may have employees but lack particular expertise, adequate coverage for critical systems, or enough time to carry out essential work. Conversely, a small team may have clear priorities and effective support. The practical test is whether the available team can cover the organization’s important systems and risks, not whether it matches an abstract staffing number.
Is there a cybersecurity skills shortage?
The surveys indicate that skills gaps are widely reported, and the UK estimate describes a separate shortfall in the flow of people into the cyber workforce. These findings are related but not interchangeable: a skills gap is about capability, while an entrant shortfall compares estimated workforce demand with estimated labor-market inflows.
ISC2’s finding that budget had become the leading cited cause of staffing shortages is important because it complicates the familiar explanation that organizations simply cannot find qualified candidates. Hiring constraints may reflect limited funds as well as talent availability. The evidence does not show that one cause dominates in every country or organization.
Why can’t organizations hire enough cybersecurity staff?
The sources point to a mismatch between the work organizations need done and the resources they can commit to it. Deloitte-NASCIO describes budget constraints contributing to understaffing and difficulty recruiting and retaining skilled workers. The UK estimate suggests that, under its assumptions, annual workforce inflows fall short of demand and replacement needs. Neither finding supports one universal explanation for hiring difficulty.
Rank #3
Security responsibilities can expand as organizations rely on more complex environments and face changing threats, while hiring, training, and budget decisions take time. This creates a timing problem: an organization may acquire new exposure or operational obligations before it can add qualified staff or fund the capabilities needed to manage them.
Why confidence can exceed demonstrated readiness
Cisco’s 2024 results show a sharp contrast between reported confidence and the proportion classified as mature on its readiness index. That difference may signal misplaced confidence, as Cisco suggested, but the measures are not identical: one is respondents’ confidence, the other an index classification. It is a reason to validate readiness rather than assume confidence proves capability.
Organizations should test whether their safeguards, incident response, and coverage work in practice. Spending more does not automatically create maturity, and automation can help with repeatable work without removing the need for skilled people to configure, monitor, and make decisions about security systems.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →How to strengthen security with limited resources
There is no source-supported intervention that is best for every organization. A useful starting point is to make the mismatch specific enough to prioritize and then choose among hiring, training, simplifying operations, or adding external capacity.
Best Value
- Map what matters. Identify critical services, the systems and data they depend on, and the exposures that could disrupt them.
- Define required coverage and skills. For each priority, specify the security work that must happen and the capabilities or coverage it requires.
- Compare requirements with available capacity. Review current staff, skills, time, and funding against those needs. Distinguish a headcount gap from a skills gap, an operating-process problem, or a budget constraint.
- Choose a response that fits the gap. Consider hiring for sustained needs, training to close specific skills gaps, simplifying or prioritizing work, or using vetted contractors for defined capacity needs. Deloitte-NASCIO’s finding that surveyed state CISOs use contractors shows this is one option, not a universal prescription.
- Set governance for external support. If bringing in contractors, define access, responsibilities, oversight, knowledge transfer, and how the organization will retain control of decisions and sensitive systems.
- Review the result against the original need. Check whether critical work is being covered and whether the remaining risks are understood. Reassess when services, exposures, or staffing change.
SANS’s 2024 SOC survey describes staffing-related answers as the largest barrier category overall and reports budget-visibility issues. For security operations teams, visibility matters: without a clear view of available funds and planned commitments, it is harder to distinguish a true resource shortage from an inability to see or direct existing resources.
What the evidence does—and does not—establish
Together, the findings support the conclusion that organizations in several surveyed populations report meaningful shortages in staffing, skills, or funding, while one UK estimate projects a net annual workforce shortfall for 2025. They do not establish a single global gap figure, prove that every organization is understaffed, or identify a universally most effective fix. Treat each number according to its source, population, and method, then measure the capacity problem in your own organization.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
