Employers say skills gaps, not empty seats, are their biggest security problem
Sixty per cent of security and hiring leaders say gaps in their existing teams' skills are a bigger problem than unfilled positions, according to the 2026 SANS | GIAC Cybersecurity Workforce Research Report, released at the RSAC conference and announced by SANS on April 1.
The finding echoes ISC2's December workforce study and shifts the hiring conversation away from raw headcount. It also contains one of the clearest data points so far on how AI is changing entry-level security work.
Key findings
SANS surveyed 947 security and talent-acquisition leaders across six regions, 56 per cent of them in North America. According to the SANS announcement:
- 60 per cent said skills gaps are the bigger problem, against 40 per cent who cited staffing shortages. A year earlier, the split was only four points.
- 27 per cent reported a breach tied directly to a workforce capability gap.
- 64 per cent ranked certifications as their top way to validate skills. Academic degrees ranked last among hiring priorities.
- Unclear career progression was cited as a hiring obstacle by 32 per cent, up from nine per cent, yet only 24 per cent offer well-defined career paths.
- 61 per cent reported more team stress over the past two years.
AI and entry-level roles
Seventy-four per cent said AI is affecting team size or role structure. Most of the effect so far is efficiency: 49 per cent cited less time spent on manual analysis, while 16 per cent reported headcount cuts. Among organizations where roles have changed, the reductions fell most on SOC analysts (32 per cent), threat intelligence analysts (26 per cent) and incident responders (22 per cent), jobs that have traditionally been entry points into the field.
At the same time, respondents reported new roles for AI and machine learning security specialists, AI security engineers and AI governance analysts. Only 38 per cent said they provide comprehensive AI security training.
SANS CEO James Lyne said practitioners who use AI "are quite likely to replace those who don't," and warned that signalling the replacement of entry-level staff could create future shortages of experts. Rob T. Lee, SANS's chief AI officer, said the issue is "no longer a story about filling seats."
The figures were also cited in a September roundup of workforce data published by CIO Influence, alongside Canadian job-posting numbers.
What to do
Hiring managers can use the findings to make the case for structured mentoring and AI training for junior staff rather than cutting entry-level roles outright. Job seekers should note that certifications remain the most common screen, and that practical experience with AI-assisted tools is increasingly expected.
