ISC2 drops its workforce gap estimate as skills shortages overtake headcount

Shortages of specific skills, not a lack of bodies, are now the main problem facing security teams, according to the 2025 Cybersecurity Workforce Study that ISC2 published Dec. 4. For the first time in years, the certification body did not publish an estimate of the global cybersecurity workforce gap.

The change matters for anyone planning a career or a training budget. The headline number long cited in hiring debates is gone, replaced by data on which capabilities teams lack and what happens when they lack them.

What the study found

ISC2 surveyed 16,029 practitioners and decision-makers in North America, Latin America, Asia-Pacific and Europe, the Middle East and Africa in May and June 2025. According to ISC2's summary:

• 95 per cent of respondents reported at least one skills need, up five points from 2024, and 59 per cent reported critical or significant skills needs, up 15 points.
• 88 per cent said they had experienced at least one significant security consequence because of a skills shortage, and 69 per cent had experienced more than one.
• Reports of budget cuts (36 per cent) and layoffs (24 per cent) each fell by one point, which ISC2 described as early stabilization rather than recovery.
• 33 per cent said their organization lacks the resources to staff its security team adequately, and 29 per cent said it cannot afford staff with the skills it needs.
• 72 per cent agreed that cutting security staff significantly increases breach risk.

AI tops the skills list

AI was the most-cited needed skill, at 41 per cent, ahead of cloud security at 36 per cent. Twenty-eight per cent of respondents said their organization had integrated AI tools into security operations, and 69 per cent were involved in some stage of adoption, from evaluation to deployment. Most expect AI to raise the bar: 73 per cent said it will create more specialized skill needs.

Debra Taylor, ISC2's acting CEO, said the most pressing concern for teams "isn't headcount but skills." CSO Online described the results as a widening skills gap that grows as professionals adopt AI, even as budget pressure eases.

Morale and retention

Job satisfaction rose two points to 68 per cent, and 87 per cent said there will always be a need for security professionals. Burnout remains a concern: 48 per cent said they feel exhausted keeping up with threats and new technology, and 47 per cent feel overwhelmed by their workload. Three in four plan to stay with their current employer for the next year.

What we don't know yet

ISC2's public summary does not break out Canadian results, salaries or the size of the workforce. Readers looking for Canadian numbers will need country-level data from other sources, such as Canadian job-posting trackers and provincial labour data.