Today’s entry-level cybersecurity applicants could become part of the leadership talent pool in 2031—but no available study tracks current applicants to future leadership roles. The more defensible concern is that fewer early-career opportunities, combined with employers’ difficulty filling experienced and specialist jobs, could weaken the path from first job to senior responsibility.
What the entry-level hiring data says
The clearest recent evidence of a narrowing entry point comes from the UK. The Department for Science, Innovation and Technology’s 2026 study, covering 2025 conditions, found that applicants with less than one year of experience were sought in 16% of core cyber job postings. That was down from 25% in 2022 and 17% in 2024. Nearly two-thirds of core cyber postings required mid-level experience—two to six years.
As an Amazon Associate I earn from qualifying purchases.
Those figures describe UK job postings, not the number of people hired or a global trend. They nevertheless point to a familiar barrier: many roles ask for experience, while fewer postings are aimed at people just starting out.
Education requirements can narrow the route in
In the same UK study, 77% of employers required at least a bachelor’s degree or equivalent for a core cyber role, and 10% sought postgraduate qualifications. Twelve percent were open to applicants with GCSE, A-Level, or foundational-level education. These are reported employer requirements, not proof that a degree is necessary for every cybersecurity career path.
#1 Best Overall
Why a smaller entry point could matter later
Cybersecurity leaders generally need more than technical knowledge: they must develop judgment about risk, communicate priorities, and make decisions with incomplete information. Early-career work can provide an opportunity to build that foundation, but a job title alone does not guarantee a route to leadership. Employers need to create meaningful work, supervision, and progression if they want junior hires to develop.
The UK findings show a tension in the current pipeline. Among the 66 cyber businesses in the study that had hard-to-fill vacancies, 56% said experienced or senior roles—typically requiring three to five years’ experience—were hard to fill, and 35% reported difficulty filling principal-level roles, typically requiring six to nine years. Entry-level staff or graduate roles were hard to fill for 23% of those businesses. These percentages apply to that subset of surveyed businesses, not all UK employers.
Within that same hard-to-fill-vacancy group, the specialisms most often cited were cyber governance and risk management (27%), security testing (24%), and secure system architecture and design (24%). The results do not prove that today’s junior applicants will fill those future posts. They do illustrate why an employer that cannot recruit experienced specialists may have reason to invest in developing people earlier in their careers.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Rank #2
What employers say they will consider—and what training takes
ISC2’s 2025 Cybersecurity Hiring Trends report surveyed 929 cybersecurity hiring managers in Canada, Germany, India, Japan, the UK, and the US in December 2024. It asked how managers prioritize skills and train entry- and junior-level cyber professionals. The findings describe what respondents said they would consider, not a ranking of candidates actually hired.
| Candidate background | Managers who said they would consider it |
|---|---|
| Prior IT work experience only | 90% |
| Entry-level cybersecurity certifications only | 89% |
| Relevant IT, cybersecurity, or computer-science education only | 81% |
The responses suggest employers need not treat a degree as the only possible starting point. Prior IT work or an entry-level certification may also bring a candidate into consideration, though the survey does not establish that any route guarantees an offer.
Junior hires need time and support
In the ISC2 survey, 56% of managers said entry-level professionals typically take four to nine months to handle tasks independently. Ninety-one percent said they provided professional development to early-career employees during work hours. Hiring junior staff therefore entails a real investment in supervision and development, rather than simply filling a vacancy at a lower experience level.
Tasks managers reported assigning to entry-level professionals included documentation (43%), alert and event management (35%), reporting (32%), physical access controls (30%), and user awareness training (29%). These are survey results, not a universal job description. They show examples of work that can introduce new hires to security processes and organizational needs.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Could AI remove the first rung?
The UK government’s 2026 report records qualitative concern from research participants that agentic AI could take on routine security operations center tasks, potentially weakening a traditional training route for junior staff. That is a concern about a possible pipeline effect—not a measured count of junior jobs already eliminated.
The same report found that 70% of cyber security firms said staff used AI in daily work, and 73% expected their need for AI skills to increase over the next 12 months. These are findings about the study’s timeframe, not a forecast for 2031. They make the practical question less about whether AI will affect security work and more about whether employers will preserve supervised work through which newcomers can learn.
A separate global survey summarized by SANS Institute and GIAC Certifications in its 2026 workforce report found that 74% of 947 respondents said AI was changing team size or role structures. In that survey, 60% cited skills gaps as a workforce challenge and 40% cited headcount shortages; only 4% said they struggled to fill entry-level roles, with recruitment difficulty concentrated at mid-level and above. These are that report’s survey results and should not be read as directly comparable with the UK findings, which use a different population and measure.
How employers can build a path from first job to leadership
The World Economic Forum’s 2024 Strategic Cybersecurity Talent Framework organizes action around attracting talent, educating and training professionals, recruiting the right talent, and retaining professionals. Applied to the entry-level pipeline, those priorities suggest several practical choices. They are a framework for decision-making, not a guarantee of future leaders.
Attract people through more than one route
- Describe the skills and work a role actually requires, and avoid treating a degree as a substitute for assessing relevant ability.
- Consider applicants with prior IT experience, entry-level certifications, or relevant education. ISC2’s survey found hiring managers willing to consider all three backgrounds, though willingness does not establish hiring outcomes.
Teach through real, supervised work
- Give early-career staff tasks with a clear connection to security operations, documentation, reporting, access controls, or user education.
- Plan for the training time required to reach independent work. In ISC2’s survey, 56% of managers put that period at four to nine months.
- If automation takes over routine tasks, identify other supervised assignments that still teach investigation, risk, communication, and decision-making.
Recruit for capability and progression
- Assess whether candidates can learn and work carefully, not only whether they have already held the same job title.
- Make the next steps visible: explain how early-career work can build toward specialist responsibilities and, for those suited to it, leadership.
Retain the people who develop
- Provide development during work hours and opportunities to apply new skills.
- Review whether junior employees can move into more complex work, rather than leaving them indefinitely in repetitive tasks.
Read workforce-shortage figures with care
Headcount openings, unfilled vacancies, skills gaps, and employer difficulty hiring are related but distinct measures. The US National Center for Science and Engineering Statistics has warned that estimates vary with data sources, occupation definitions, years, and search terms. Its report contrasts more than 570,000 US openings estimated by CyberSeek for 2023 with more than 480,000 unfilled openings in an ISC2 estimate for the last calendar year cited in that report. Those figures are not a single time series and should not be added together or presented as a current count.
NIST’s October 2024 update described CyberSeek as a free career-seeker tool offering job titles, salaries, and credential information. It reported that nearly 265,000 more US cybersecurity workers were then needed to address staffing needs. That is a historical snapshot from the update, not a 2026 workforce measurement. Likewise, the World Economic Forum’s 2024 framework cited a global shortage estimate of nearly four million cybersecurity professionals; it is a dated estimate, not a current 2026 count.
What the evidence can—and cannot—say about 2031
The evidence supports a conditional argument: if employers reduce junior opportunities without creating other ways for new people to learn, the future pool of experienced cybersecurity professionals could be harder to build. UK posting data show less entry-level demand than in 2022, while some employers report difficulty filling experienced and specialist roles. Survey findings also indicate that managers consider multiple entry routes and that early-career development takes time.
But the evidence does not identify who will lead cybersecurity teams in 2031, establish that today’s applicants will become those leaders, or prove that AI has already removed a defined number of junior jobs. The outcome will depend in part on whether employers keep creating useful, supervised entry points as the work changes.
Recommended Free Tools
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
