Cybersecurity Workforce Gap Statistics 2026: Openings, Shortages and Skills

US employers posted 514,359 security job listings in a year

CyberSeek, a project of NIST's NICE program, Lightcast and CompTIA, counted 514,359 US job listings for cybersecurity roles and technical jobs with heavy security requirements from May 2024 through April 2025. That was up nearly 57,000, or 12%, from 457,398 in the prior 12 months.¹² It estimates that 1,337,400 people are employed in those jobs and puts the national supply-demand ratio at 74%, a measure of available workers relative to employer demand. Recruiting periods were 21% longer than average, and about 10% of listings asked for AI skills.²

• The 10 states account for 284,749 listings, 55.4% of the national total.
• Virginia had 9,511 more listings than California, though California employs about 25,000 more cybersecurity workers.
• A lower ratio means fewer available workers for each opening. Virginia, at 69.1%, is the tightest of the large state markets, and the District of Columbia, with 15,064 listings, is tighter still at 66.5%.

CyberSeek also maps listings to the categories of NIST's NICE Workforce Framework. Oversight and governance roles led with 355,590 listings, followed by implementation and operation at 335,993, design and development at 331,644, protection and defense at 238,516 and investigation at 19,525. A listing can fall into more than one category, so these figures add up to more than the total.²

US security job postings fell 26.4% in 2026

CyberSN, a cybersecurity recruiting firm, counts deduplicated US job postings by the work they describe. It found 235,786 postings from January through September 2026, down 26.4% from 320,210 in the same months of 2025 and the lowest total for that period in four years. Eight of the nine months ran below the same month of 2025, and CyberSN projects a full-year 2026 total of 288,911 to 325,540, against 392,356 in 2025.³

• Security engineers were the most posted role, with 44,083 postings, or 18.7% of the total.
• AI security engineer postings more than tripled, but at 2,409 they equal about 1% of all postings. CyberSN counts that role within security engineering.
• Only 9.5% of 2026 postings were for entry-level work, by CyberSN's reading of the listings. The decline leaves the fewest openings for people trying to enter the field.

The mix of work is also changing. Governance, risk and compliance roles took 14.8% of postings in the first nine months of 2026, up from 9.4% in the same months of 2023, while defense roles fell from 47.1% to 41.5%. About 14.6% of postings mentioned AI or machine learning.³

CyberSeek and CyberSN count differently. CyberSeek includes technical jobs with heavy security requirements and covers a different 12-month window, so its totals run higher than CyberSN's. The two agree that demand rose into 2025, and CyberSN's data shows it falling through most of 2026.

The last global gap estimate was 4.8 million

ISC2 estimated the global cybersecurity workforce at 5,468,173 people in 2024 and the workforce gap, the number of additional professionals organizations say they need, at 4,763,963. The gap grew 19.1% that year while the workforce grew 0.1%.⁵ In 2022 ISC2 had put the gap at 3,432,476 and in 2023 at 3,999,964.⁷⁶ In North America the workforce shrank 2.7% to 1,454,868 and the gap rose 4.0% to 542,687.⁵ ISC2's last US-only figures, for 2023, put the US workforce at 1,338,507 and the US gap at 482,985.⁶

• The global gap grew 38.8% from 2022 to 2024, to 4,763,963.
• North America's gap equaled 37.3% of its workforce in 2024, up from 32.4% in 2022.
• ISC2's gap measures the staff organizations say they need, not open jobs. By that measure, North American organizations were short about 27% of the security staff they needed in 2024.

ISC2 did not publish a gap estimate in its 2025 study. It said respondents in 2024 and 2025 "prioritized the need for critical skills as more important than the need for more people." In the same survey, 34% said their organization had the right number of security staff, up from 30% in 2023 and 2024, and 4% reported a surplus.⁴

Teams still report shortages. In ISACA's 2026 State of Cybersecurity survey of more than 1,800 professionals, 58% said their cybersecurity team was understaffed, up from 55% in 2025, and 49% reported open security positions. More than half, 55%, had difficulty retaining qualified staff, and high work stress was the most common reason people left, cited by 52%.⁹

Budgets now limit hiring as much as candidates do

ISC2's surveys show the cutbacks that reached security teams in 2024 leveling off in 2025. Budget cuts were reported by 36% of respondents, against 37% in 2024 and 30% in 2023, and hiring freezes by 39%.⁴⁸

• Every measure stayed above its 2023 level, and hiring freezes and fewer promotions rose again in 2025.
• At organizations with 10,000 or more employees, 32% reported security layoffs and 49% hiring freezes. At organizations with fewer than 100 employees, 17% reported layoffs.
• Asked about the causes of skills shortages, 30% said they could not find people with the skills and 29% said they lacked the budget to hire enough staff. In this data, money limits hiring about as often as candidates do.

Respondents see a cost to the cuts. In ISC2's 2025 survey, 33% said their organization did not have the budget to staff its security team adequately, and 72% agreed that reducing cybersecurity staff significantly increases the risk of a breach.⁴

The certifications and skills in shortest supply

CyberSeek publishes how many job listings request each major certification and how many people hold it. Dividing holders by listings shows where the certified pool runs short.¹ There were 20,300 holders of ISACA's CISM management certification for 44,347 listings that asked for it, and 35,812 holders of the CISA audit certification for 52,337 listings.

• CISM listings outnumbered CISM holders by 24,047, and CISA listings outnumbered CISA holders by 16,525.
• CISSP was the most requested certification, with 82,494 listings and 1.11 holders for each.
• Security+ is an entry-level credential, with 3.80 holders per listing. The shortfalls are in management and audit certifications, which take years of experience to earn.

ISC2's 2025 survey found skills needs widening even as staffing levels improved slightly. In all, 95% of respondents reported at least one skills need, and 59% described their needs as critical or significant, up from 44% in 2024. AI was the most cited need for the second year.⁴⁸

• AI rose 7 points and cloud security 6 points, while zero trust and forensics each fell 3 points.
• In all, 88% of respondents said a skills shortage had caused at least one significant problem, such as misconfigured systems or underqualified people placed in roles.
• ISACA's 2026 survey points the same way: 45% saw a skills gap in securing large language models, 21 points higher than in 2024. Teams hiring for AI security are competing for a skill that most of the field is still learning.

What the work pays and how fast it is growing

Information security analysts earned a median $129,180 in May 2025, according to the Bureau of Labor Statistics, about 2.5 times the $50,980 median for all US occupations. The lowest-paid 10% earned less than $75,090 and the highest-paid 10% more than $199,850. BLS projects employment in the occupation to grow 21% from 192,900 jobs in 2025 to 233,400 in 2035, against 3% for all occupations, with about 14,100 openings a year.¹⁰

• Median pay in the information industry was $13,230 higher than in consulting services.
• BLS counts 192,900 information security analysts, while CyberSeek counts 1,337,400 people in cybersecurity-related jobs. The BLS figure covers one occupation, while CyberSeek includes engineers, architects, managers and auditors with security duties.
• Raises have been modest. In ISC2's 2025 survey, 20% of respondents received no raise in the past year and 57% received 1% to 9%.⁴

What the figures mean for employers and job seekers

The shortage has not closed, but it has changed shape. Most teams still say they are understaffed, yet US postings fell by about a quarter in 2026 and ISC2 no longer publishes a gap figure, because its respondents rank missing skills above missing people.

The clearest shortfalls in the data are in experienced roles: CISM and CISA holders are outnumbered by the listings that ask for them, and AI and cloud security top the skills lists. Entry-level postings are scarce.

So if you are hiring, budget for experienced governance, audit and cloud security staff, where the certified pool is smallest, and look at training current employees for AI security work.

If you are looking for work, expect competition at entry level, where Security+ holders outnumber the listings that ask for it almost four to one. Security professionals in ISC2's 2025 survey cited AI and cloud security as their teams' biggest skills needs, and in experienced governance and audit roles, listings that ask for CISM or CISA outnumber the people who hold those certifications.

Sources

1. CyberSeek (NICE, Lightcast and CompTIA), Cybersecurity Supply and Demand Heat Map
2. CyberSeek, June 2025 data release: Cybersecurity job postings of 514,000 up over prior reporting period
3. CyberSN, Cybersecurity Jobs Report, 2026 through September
4. ISC2, 2025 Cybersecurity Workforce Study
5. ISC2, 2024 Cybersecurity Workforce Study
6. ISC2, 2023 Cybersecurity Workforce Study
7. ISC2, 2022 Cybersecurity Workforce Study
8. ISC2, Growth of Cybersecurity Workforce Slows in 2024 as Economic Uncertainty Persists (September 2024)
9. ISACA, 2026 State of Cybersecurity survey release (September 2026)
10. US Bureau of Labor Statistics, Occupational Outlook Handbook: Information Security Analysts

Methodology

US job listing, employed workforce, supply-demand ratio and certification figures come from CyberSeek's heat map data for its current period, May 2024 through April 2025, and its June 2025 data release. CyberSeek's supply-demand ratio is its own measure of available workers relative to employer demand. Holders per listing are calculated by CyberReviewed by dividing CyberSeek's national certification holder counts by its counts of listings requesting each certification, and rounded to two decimal places. 2026 posting figures come from CyberSN's Cybersecurity Jobs Report, which counts deduplicated US postings from JobSpikr data pulled October 7, 2026. Workforce and gap estimates come from ISC2's 2022, 2023 and 2024 Cybersecurity Workforce Studies; the 2024 global figures use the totals in the study's text, which differ slightly from its figure labels. ISC2 did not publish a gap estimate in 2025. The 2023 cutback shares are derived from the year-on-year changes printed in ISC2's 2024 release. 2024 skills shares come from the five skills that release lists, so skills outside its top five are shown as not in the top five. ISACA figures come from its 2026 State of Cybersecurity survey release. Pay and projections come from the BLS Occupational Outlook Handbook for information security analysts. Percentages and differences are calculated from the published figures and rounded once. All money is in US dollars.