Skills Shortage Holding Back Cybersecurity Push Despite Board Support

Elizabeth Greenberg

11 November 2026, 09.00am

“As AI infiltrates every aspect of the cybersecurity domain, so the cybersecurity profession is changing,” Chris Dimitriadis, Chief Global Strategy Officer at ISACA, commented.

ISACA’s 2026 State of Cyber report reveals that the cybersecurity industry faces serious recruitment and retainment issues.

The value of cybersecurity is being realised as incidents such as the PHP crisis force governments and organisations around the world to take their websites offline.

However, that realisation has yet to translate to funding and staffing.

Perceptions of cybersecurity are shifting, making it more of an organisational priority

Almost eight in ten European IT and cybersecurity professionals (77%) say their cybersecurity strategy is aligned with organisational objectives, a slight increase from 72% in 2025.

Over half (56%) believe their board has adequately prioritised cybersecurity, and 42% say their organisations’ cybersecurity budgets are set to increase in the next 12 months. Credentials matter to 84% of hiring managers, but 29% are also developing security talent from within.

However, European organisations are struggling to retain staff

Nearly three in five of those surveyed (57%) report organisational difficulty with holding onto skilled cybersecurity professionals, an increase of five percentage points from last year.

Employees feel trapped in a vicious cycle, with more than a quarter (26%) believing roles are more stressful than five years ago due to hiring and retention challenges, and over half (52%) suggesting high work stress as a reason for leaving. alf of respondents also cite poor financial incentives (49%) and limited promotion and development opportunities (50%) as key reasons for leaving a role.

Nearly half (46%) of cybersecurity professionals say that on average it takes their organisation three to six months to fill an entry-level position, and a third (30%) say it takes over six months to fill non-entry-level roles. Demand is high for incident response expertise, but training provision lags behind. More than half (55%) of those surveyed identified incident response as the area of training most needed amongst security staff with less than three years work experience.

Chris Dimitriadis, Chief Global Strategy Officer at ISACA, commented: “As AI infiltrates every aspect of the cybersecurity domain, so the cybersecurity profession is changing. Today, cybersecurity professionals are responsible for securing AI agents, operating in a world of human-AI collaboration across resilience, crisis management, audit and incident analysis.

“While recent cyber attacks have heightened recognition of the importance of investing in cybersecurity, recognition alone is not enough. In this industry, we can’t afford to reach breaking point. Boards have to translate their priorities into action and that means providing adequate funding to attract, hire, train, and upskill cybersecurity professionals.

“Without a skilled cybersecurity workforce, organisations leave themselves vulnerable to chance, to bad actors, and to rogue AI attacks. As with any workforce, morale and working conditions are essential to attracting and retaining the right professionals with the abilities to bolster an organisation’s cyber resilience. An idealistic but passive board translates to underfunded, overworked, apathetic cybersecurity teams – who will not be able to prevent or protect against attacks.”