The article also points to an operating-model problem: security is still too often treated as a specialist function that reviews work late rather than shaping it early. Leaders should test whether funding, delivery metrics, and release incentives are rewarding speed while externalizing cyber risk into future remediation, incidents, and technical debt. If so, the skills gap will keep reappearing as a portfolio governance failure, not just a hiring challenge.
AI raises the stakes because it can improve analyst productivity while simultaneously creating new oversight demands. The practical question is not whether to adopt AI-enabled security tools, but where human validation remains mandatory, who owns model and data risk, and how teams will be trained to assess AI outputs. Enterprises that buy tools before clarifying governance may add noise faster than they add resilience.
Useful next questions for IT leaders include:
- Which security capabilities must be built internally versus sourced through partners or managed services?
- Are product and engineering leaders measured on secure delivery outcomes, not just delivery speed?
- What minimum AI literacy is required across security, IT operations, and development teams?
- Where do current skills gaps create the highest business-impact exposure?
We’ve been talking about the cybersecurity talent gap for years. The simple reality has been there aren’t enough professionals to fill every open role worldwide. But lately, the conversation has evolved. It’s no longer just about head count; it’s about capability.
Even ISC2 shifted its focus in its latest Cybersecurity Workforce Study. Rather than estimating the size of the global workforce gap, the study now focuses on the growing gap between the skills organizations need and the capabilities their teams possess. It surveyed 16,029 cybersecurity professionals.
The consequences of the skills gap are difficult to ignore. According to ISC2, 88% of respondents faced at least one major cybersecurity consequence tied to a lack of critical skills, while 69% reported more than one. Nearly nine in 10 teams already know this gap isn’t theoretical. It’s operational.
And AI is only accelerating things. Security teams increasingly need professionals who can use AI effectively, evaluate its output, secure AI systems and recognize threats that use the same technology against them. In fact, AI was the most frequently cited cybersecurity skill needed, identified by 41% of respondents.
The real issue: opportunity cost
At the heart of the cybersecurity skills gap is opportunity cost. Most security teams aren’t short on dedication; they’re short on time. Between maintaining uptime, delivering new capabilities and keeping pace with rapid change, security often becomes something organizations bolt on rather than build in.
Security guardrails don’t build themselves. They require time, expertise and sometimes a pause in development velocity to do the job right. Yet, in the race toward innovation, it’s tempting to defer security for speed, creating future costs that are far more painful to pay.
AI adds a new dimension to this tradeoff. It can reduce the time spent reviewing alerts and processing security data, but only when teams have the skills, governance and oversight to use it responsibly.
Build strength from within
If the external talent pipeline isn’t deep enough, organizations need to look inward. The most sustainable way to close the cybersecurity skills gap is to grow talent from within. Train IT staff to think securely from day one, empower them with the right oversight, hands-on experience and continuous learning opportunities, and broaden the responsibility for security beyond the technical teams.
Development must also include AI literacy. Security professionals must know where AI adds value, where human judgment is critical, and how to evaluate its findings. Some teams will also need expertise in securing AI systems and data, and in governance.
Another important change is happening within organizations: They are realizing that every employee in every department plays a role in protecting data, customers and the company reputation. Security awareness training is critical, but corporate culture makes the biggest difference. When people understand that cybersecurity enables the business to move faster and more safely, they start to see it as part of the mission.
Of course, some capabilities still need targeted investment. Specialized disciplines like threat hunting, security operations center or application security can’t be developed overnight. These roles are evolving as professionals take on more responsibility for evaluating AI-generated findings, securing AI-enabled systems and responding to AI-supported attacks.
That’s where strategic hiring and managed services can step in, helping organizations shore up specific weaknesses while continuing to build internal capacity.
Culture: The hidden multiplier
Even the most talented security teams fall short if organizational culture doesn’t align. One of the most common mistakes is hiring skilled professionals without addressing the broader culture. Security is a partnership and a team sport, so building a security culture, training staff and getting leadership and cross-functional members on board ensures that incoming talent has willing allies as they implement their strategic initiatives.
A strong security culture starts with three fundamentals:
-
Positioning security as an enabler of business innovation so employees understand that guardrails help the business move faster and operate more consistently over time.
-
Making everyone responsible for safeguarding the business and customers, not just those with security in their job title.
-
Building partnerships between security and business leaders by listening, learning and moving forward together to foster collaboration and shared outcomes.
AI: A partner, not a replacement
The ISC2 Cybersecurity Workforce Study found that 69% of organizations are already integrating or evaluating AI-driven security tools. Most organizations see the biggest potential in network monitoring, threat detection and vulnerability management, tasks that are data-heavy and time-intensive.
But AI isn’t replacing cybersecurity professionals. Human expertise remains essential for validating findings, providing business context, investigating suspicious activity and determining the right response. AI can flag a potential threat, but people decide what it means and what actions to take.
AI amplifies but does not replace cybersecurity teams. The most effective security programs combine AI’s speed and scale with the judgment, experience and accountability that only people can provide.
There’s no single solution to the cybersecurity skills shortage. Progress requires a layered strategy: developing internal talent, building a culture of shared security, using managed services where needed, and adopting AI and automation to make skilled professionals more effective.
In today’s threat landscape, success isn’t defined by the size of your security team. It’s determined by how well you develop, empower and equip your people to meet evolving threats.
Enjoyed this article? Sign up for our newsletter to receive regular insights and stay connected.