The workforce gap is a capability problem, not only a hiring problem.
ISC2's 2023 Cybersecurity Workforce Study estimated that roughly 4 million additional cyber security professionals were needed globally. Its 2024 study put that figure at 4.8 million. Those estimates describe the scale of the workforce gap; they are not a count of open vacancies or a direct measure of every organisation's skills shortage.
The useful operational question is more specific: can the people responsible for your systems carry out the security work your organisation depends on? That can include interpreting alerts, securing cloud changes, prioritising vulnerabilities, testing applications, responding to incidents, or explaining risk to decision-makers.
Sources: ISC2 Cybersecurity Workforce Study 2023 and ISC2's 2024 workforce-study update.
Skills outlook
The skills rising fastest through 2030.
The World Economic Forum's Future of Jobs Report 2025 places networks and cybersecurity second in its top 10 fastest-growing skills by 2030. The list also shows why cyber security teams need more than a narrow technical toolkit.
| Rank | Skill |
|---|---|
| 1 | AI and big data |
| 2 | Networks and cybersecurity |
| 3 | Technological literacy |
| 4 | Creative thinking |
| 5 | Resilience, flexibility and agility |
| 6 | Curiosity and lifelong learning |
| 7 | Leadership and social influence |
| 8 | Talent management |
| 9 | Analytical thinking |
| 10 | Environmental stewardship |
Source: World Economic Forum, The Future of Jobs Report 2025 — Skills outlook.
What this means for security teams.
Networks and cybersecurity will grow alongside AI, data, and technological literacy. A useful security programme should therefore develop both specialist depth and the adjacent skills that make the work effective: analytical thinking to investigate evidence, communication to explain risk, and curiosity to adapt to new systems and threats.
Turn a gap into a practical plan.
Start with the security outcomes that matter over the next 6 to 12 months. Identify the tasks that are high-risk, frequent, or dependent on one person. Then map those tasks to roles, current confidence, and the practical evidence each person should be able to produce.
That creates a more useful plan than a generic course catalogue. It might mean foundations training for an emerging analyst, a hands-on path for a penetration tester, or a focused programme for an IT team taking on security responsibilities.
Build practical cyber security capability.
Explore role-focused learning paths, or use the training assessment to identify the most useful next step for an individual or team.