In partnership with
Cybersecurity is often described through a single worldwide worker-shortage number. That shorthand can obscure what employers actually need and what career evidence supports. The 2025 ISC2 workforce study shifted attention from raw headcount toward specific skill needs. It surveyed 16,029 people responsible for cybersecurity in workplaces across North America, Latin America, Asia Pacific, and Europe, the Middle East, and Africa.
Learn AI in 5 minutes a day
You don't have to scroll every AI thread, track every new tool, or watch every demo.
The Rundown AI breaks it all down for you — the latest AI news, tools, and tutorials in one free 5-minute email every morning.
Trusted by 2M+ professionals at Apple, Google, and NASA.
Eighty-eight percent of respondents reported at least one significant cybersecurity consequence in their organization during the prior year because of skills shortages. This is self-reported survey evidence, not a count of independently audited incidents. ISC2 did not publish a global workforce-gap estimate in its 2025 study. It said participants emphasized skills and staffing needs instead of a single headcount comparison. The study surveys practitioners and decision-makers, not job seekers or all vacancies.
That distinction matters to people exploring employment. A skills shortage does not prove employers have open jobs in every location, can fund new hires, or will accept a particular credential. The same study described economic pressure, including layoffs, hiring freezes, promotion freezes, and budget reductions. Large organizations reported these pressures too. The research documents both demand for capability and limits on hiring or progression.
A practical way to map the work is the NICE Workforce Framework for Cybersecurity, maintained by the United States National Institute of Standards and Technology. Its current components describe 42 work roles across five broad categories: oversight and governance, design and development, implementation and operation, protection and defense, and investigation. The framework offers common language for learners, employers, educators, and organizations.
Popsmith’s Investment Round Won’t Be Open Long
Where does a popcorn brand go after $20M in lifetime revenue? For Popsmith, it’s a projected $9M in 2026, up about 73% from 2025, and a nationwide launch in Williams Sonoma stores this holiday season. Own part of it before the raise closes.
NIST cautions that a work role is not the same thing as a job title or occupation. One employer’s security analyst position may combine tasks from several framework roles. A role description links tasks to the knowledge and skills used to perform them. This makes the framework more useful for comparing capabilities than predicting a specific job title or salary.
Some work centers on identifying risks and protecting systems. Other work involves designing secure technology, managing organizational risk, maintaining systems, or examining digital evidence. These categories describe different responsibilities. They do not form one compulsory ladder. NIST materials separate capability from seniority and note that relevant skills can be developed outside degree-based routes.
The framework also shows why cybersecurity is not one technical specialty. NIST’s competencies include cloud security, access controls, artificial-intelligence security, supply-chain security, and operational technology. ISC2 respondents likewise described changing technology and threats as sources of skill needs. Neither source establishes that every employer values these areas equally. Local vacancies and job descriptions determine which capabilities matter in a particular market.
A careful career assessment can start by comparing tasks rather than collecting credentials at random. A learner can identify a role of interest, examine its task and skill statements, and compare them with vacancies where they are eligible to work. Demonstrable work samples or relevant experience may help show capability, but do not ensure hiring. Frameworks organize information; employers still decide how to recruit.
The evidence supports a measured conclusion. Cybersecurity organizations report material skill needs across several world regions, while survey findings also show pressure on budgets and staffing. Role frameworks translate the broad field into responsibilities and capabilities. They cannot promise online income, remote work, a salary level, or a universal entry path. Future issues can track whether these skill needs become accessible jobs; today’s framework maps the work without promising an outcome.
Your AI prompts are leaving out 80% of what you're thinking.
When you type a prompt, you summarize. When you speak one, you explain. Wispr Flow captures your full reasoning (constraints, edge cases, examples, tone) and turns it into clean, structured text you paste into ChatGPT, Claude, or any AI tool. The difference shows up immediately. More context in, fewer follow-ups out.
Used by teams at Microsoft, Amazon, and Notion. Try Wispr Flow free on Mac, Windows, iPhone, and Android.
