Skills shortages are the top concern among cybersecurity professionals, surpassing concerns about headcount this year, according to ISC2’s 2025 Cybersecurity Workforce Study.

Conducted by the leading non-profit member organisation for cybersecurity professionals, 16,029 cyber workers were surveyed on their leading concerns, top lessons learns, and challenges they anticipate for the next year.

The previous year saw a surge in layoffs, budget cuts, and hiring and promotion freezes.

However, the 2025 data revealed that economic conditions that affect cybersecurity teams showed signs of levelling off, with reports of budget cuts (36%), and layoffs (24%) decreasing by one percentage point in 2025.

Strained cybersecurity workforce budgets remain a key driver of staff shortages, according to the study. 33% of respondents stated their organisations do not have the resources to adequately staff their teams, while 29% said they cannot afford to hire staff with the skills they need to adequately secure their organisations. Consequently, 72% of respondents agree that reducing security personnel significantly increases the risk of a breach in their organisations.

Skills Shortages Beat Headcount as Top Concern

The study highlights that while staffing shortages remain, professionals are more concerned about critical skills needs than staffing numbers. Nearly nine in ten respondents (88%) have experienced at least one significant cybersecurity incident in their organisation because of a skills shortage, and 69% have experienced more than one.

The majority of respondents (95%) reported that they have at least one skill need (a 5% increase from 2024), and 59% cited critical or significant skill needs (a 15% increase from 2024).

“A shift is happening. This year’s data makes it clear that the most pressing concern for cybersecurity teams isn’t headcount but skills,” said ISC2 Acting CEO and CFO Debra Taylor, CC.

“Skills deficits raise cybersecurity risk levels and challenge business resilience. At the same time, we are seeing emerging technologies like AI are perceived as less of a threat to the workforce than anticipated.

“Instead, many cybersecurity professionals view AI as an opportunity for career advancement. They are using AI tools to automate tasks, and they are investing their time to learn more and demonstrate their expertise in using and securing AI systems.”

The AI Effect

The research found that AI adoption is progressing among cybersecurity professionals with 28% of respondents having already integrated AI tools into their operations. In total, 69% are engaged in adoption activities – whether through integration, active testing, or early evaluation.

Data also suggests that cybersecurity professionals believe AI will create a need for new skills and perspectives within the cybersecurity workplace.

Nearly three in four (73%) believe AI will create more specialised cybersecurity skills, with about the same amount (72%) saying AI will create the need for more strategic cybersecurity mindsets. Two-thirds (66%) say AI will require broader skillsets across the workforce.

AI remains one of the top skills needed for the second consecutive year. This year, 41% of respondents cited AI as a top skill needed followed by cloud security (36%).

Nearly half (48%) of respondents are already working to gain more generalised AI knowledge and skills, while others are educating themselves on AI solutions at risk to better understand vulnerabilities and exploits (35%).

Recommended reading

• Cybersecurity Workforce Growth Stalls, Skills Gap Widens
• ISC2 Survey: Women Comprise 22% of the Cybersecurity Workforce
• ISC2: Cybersecurity Workforce Growth Slows Despite AI Catalyst

Positivity Amid Challenges

Although economic uncertainty and workplace pressures continue, cybersecurity professionals remain positive about their role in the industry.

Just under nine in ten (87%) of cyber professionals believe there will always be a need for their profession, with 81% confident the profession will remain strong.

While eight in ten (80%) are passionate about their work, 68% are satisfied in their current job, an increase of two percentage points from 2024.

Three quarters (75%) are likely to stay in their current organisation for the next 12 months, dropping to 66% when asked about their outlook over the next two years.

However, the report also indicates that cybersecurity professionals are experiencing job stress and burnout. Almost half (48%) of respondents feel exhausted from trying to stay current on the latest cybersecurity threats and emerging technologies and 47% feel overwhelmed by the workload.

The study finds that opportunities for career growth and recognition are important factors for professionals in the industry. Nearly one-third (31%) of participants view advancement opportunities and 23% view unplanned financial or benefit rewards (such as spot bonuses for performance, extra paid day off) as key factors for their workforce engagement.