Cybersecurity employers need both enough staff and the right capabilities—and hiring only for a degree or long prior experience can exclude people who could grow into the work. ISC2’s 2025 surveys point to practical alternatives: assess job-relevant skills, consider varied career paths, use internships and apprenticeships, and make junior-role expectations realistic. These approaches broaden the pool; the surveys do not prove that any one of them will eliminate a shortage.
What does “cybersecurity job shortage” mean?
The phrase can describe different problems: too few people on a team, difficulty finding workers with particular skills, or an estimate of a gap between workforce supply and demand. Those measures are not interchangeable. A reported staffing shortage is not a count of open jobs, and a skills gap does not necessarily mean an employer cannot hire anyone.
As an Amazon Associate I earn from qualifying purchases.
ISC2’s 2025 workforce study shifted toward specific skill and staffing needs and did not publish a headline workforce-gap estimate. The organization said participants prioritized understanding which skills were needed and how to develop them. As a result, older estimates should not be presented as a current count of unfilled cybersecurity positions.
For context, ISC2’s 2024 study estimated a global cybersecurity workforce of 5.5 million, up 0.1% year over year. In that survey, 67% of respondents perceived a staffing shortage and 90% reported skills gaps. Those are 2024 estimates and respondent reports, not interchangeable measurements or current open-job totals. ISC2’s 2024 findings
#1 Best Overall
Why does creative hiring matter?
Employers may need more people, but adding headcount alone will not necessarily resolve shortages if new hires lack the skills a team needs or the capacity to develop them. In ISC2’s 2025 workforce study, managers most often selected problem solving, collaboration, communication, willingness to learn, and strategic thinking as skills they sought.
| Skill | Hiring managers selecting it | How to assess it in a role-related exercise |
|---|---|---|
| Problem solving | 29% | Ask the candidate to investigate a sample alert, explain what evidence they would gather, and identify what they do not yet know. |
| Collaboration | 24% | Use a scenario that requires coordination with an IT or operations colleague, and ask how the candidate would share findings. |
| Communication | 22% | Ask for a concise incident update written for a non-specialist stakeholder. |
| Willingness to learn | 20% | Discuss how the candidate approached an unfamiliar technical task and acted on feedback. |
| Strategic thinking | 16% | Ask how they would prioritize several issues given limited time and explain the trade-offs. |
These are the shares of surveyed managers who selected each skill, not a ranking of universal job requirements. A useful interview ties each capability to the work at hand rather than treating it as a vague personality trait. ISC2’s 2025 workforce study
Which routes into cybersecurity do employers overlook?
A cybersecurity career does not always begin with a cybersecurity degree. In ISC2’s 2025 workforce study, 56% of respondents said they entered through an IT pathway. Other reported routes included cybersecurity education (10%), non-IT professional experience (8%), certifications (6%), self-directed learning (4%), military backgrounds (3%), and internships or apprenticeships (3%).
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Among respondents aged 21–29, 38% entered through routes other than IT or cybersecurity education, while 23% entered through a cybersecurity degree. These figures describe respondents’ reported pathways; they do not establish that one route is more effective than another.
A separate ISC2 survey of hiring managers found that 90% would consider candidates with only previous IT work experience, and 89% would consider candidates with only an entry-level cybersecurity certification. Managers also cited internships (55%) and apprenticeships (46%) as useful sourcing tools, and reported finding candidates through programs outside computer science, IT, or cybersecurity. These are stated willingness and sourcing practices—not guarantees of a job or evidence that employers have dropped degree requirements across the board. ISC2’s 2025 hiring study
How can employers broaden hiring without lowering the bar?
- Define the work before the credential. Separate tasks that must be done independently on day one from those that can be taught with supervision. Match required qualifications to those tasks.
- Accept more than one form of evidence. Consider relevant IT work, certifications, structured practical exercises, and experience from adjacent professions. A credential can help demonstrate preparation, but should not stand in for assessing whether a candidate can do the job.
- Recruit through work-based routes. Use internships and apprenticeships to give candidates practical experience and employers a structured way to assess and develop talent.
- Make assessments job-relevant. Use bounded exercises that reflect actual responsibilities, such as documenting a finding or explaining how to escalate an alert. State what tools or background knowledge the exercise assumes.
- Plan for development and retention. Set aside supervision and learning time. Hiring a less-experienced worker without the support to build skills can leave both the employee and team struggling.
The studies support considering these options, but they do not provide controlled comparisons showing which pathway is fastest, cheapest, or best for every employer. Employers should weigh demonstrated skills, practical experience and supervision, time to competence, role expectations, development capacity, and access for candidates with different backgrounds.
What makes a junior cybersecurity job description realistic?
A role labeled entry-level can still demand work that requires more experience than the title suggests. ISC2’s 2025 hiring study found a notable mismatch in cloud security: 18% of surveyed managers believed entry-level professionals could handle the tasks, while 46% said junior-level expertise was required. That gap is a warning to distinguish entry-level from junior-level work and to avoid presenting advanced responsibilities as beginner tasks.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →- List essential day-one tasks separately from skills the employer will teach.
- Specify the level of supervision and escalation support available.
- Describe the practical evidence that can substitute for a particular educational route, where appropriate.
- Do not bundle advanced specialties into a junior role unless the candidate will receive suitable training and oversight.
How serious are the reported effects of skills shortages?
In ISC2’s 2025 workforce study, 88% of respondents said their organizations experienced at least one significant cybersecurity consequence in the preceding year because of skills shortages; 69% reported more than one. These are respondents’ attributions about their organizations, not an independently verified estimate proving that skills shortages caused each consequence.
The workforce study surveyed 16,029 cybersecurity practitioners and decision-makers online in July and August 2025 across North America, Latin America, Asia-Pacific, and Europe, the Middle East and Africa. Its findings reflect respondents’ reports, not a census of every employer or country. The separate hiring study surveyed 929 managers in Canada, Germany, India, Japan, the U.K., and the U.S.; all had entry- or junior-level cybersecurity staff and had recruited for such roles during the preceding two years. Its early-career findings should be read within that six-country scope.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
