For years, organizations have grappled with the “skills gap” within cybersecurity, which has been blamed for numerous issues, from increasing the costs businesses face when recovering from data breaches to leaving thousands of security positions open as vulnerabilities increase and attacks become more sophisticated.
A new research report, however, suggests organizations contribute to these issues by failing to properly onboard talent and give younger cybersecurity professionals enough time to develop the skills needed to meet today’s challenges.
The survey, published by cybersecurity training firm SkillBit and based on responses from 200 chief information security officers (CISOs), chief information officers (CIOs) and other senior business leaders, found that nearly two in three organizations expect cyber professionals to become fully productive within three months.
CISOs, however, believe it takes six months to reach full effectiveness.
At the same time, organizations are not hiring enough junior talent to develop into seasoned cyber professionals with specialized skill sets. The report found that 70% of organizations now have few roles available for candidates with less than two years of experience.
While the SkillBit survey does not explicitly explain why junior cybersecurity roles are declining, other research suggests that artificial intelligence is automating some lower-level security functions in areas such as security operations centers (SOCs). These centers have traditionally served as training grounds for those looking to build a cybersecurity career.
As a result, organizations increasingly seek cyber professionals with midlevel security skills and AI knowledge, potentially squeezing out recent graduates and others interested in the field who lack that level of experience.
The SkillBit survey also found that as technology accelerates, particularly through the deployment of AI tools, CISOs and other cyber leaders are seeing “skills decay” among their workers. Thirty-nine % reported that this is a significant problem that affects team readiness.
Experts say these trends have made it more difficult to find and recruit cybersecurity professionals with the necessary skills.
“The most important finding in this survey is not that it takes six months for a new hire to become productive. It's that the half-life of cybersecurity knowledge is shrinking faster than most organizations can train people,” said Nick Heddy, president and chief commerce officer at Pax8. “AI is accelerating the pace of change in security operations, threat detection, software development, and adversary behavior. Security leaders can no longer think about readiness as an onboarding problem. They need to think about it as a continuous learning problem.”
Although hiring, onboarding and talent retention are likely to remain ongoing challenges, cybersecurity professionals and their organizations can take steps to develop the skills needed to address emerging technology challenges, including AI, while reducing business risks.
Developing Cyber Skills as Technology and Business Needs Change
In recent years, the cybersecurity skills gap has become a business risk, not just a technical one.
Researchers with Fortinet found that 86% of organizations experienced a breach in the last year. The same report found that half cited a lack of security expertise as a contributing factor. With more companies adopting AI to bolster defenses, the absence of in-house skills to manage these tools safely is widening the gap between technology and readiness, said Shane Barney, CISO at Keeper Security.
“Cybersecurity training must be ongoing, not occasional. AI streamlines detection and efficiency, but it still relies on human oversight and sound governance to operate securely,” Barney told Dice. “Security teams need the skills to interpret data, validate AI-driven insights and act with precision and accountability.”
Organizations best prepared to withstand today’s threats align skilled people, advanced technology and a culture of accountability.
“When teams are empowered to make informed decisions and supported by intelligent, well-governed systems, access remains tightly controlled, visibility stays comprehensive and real-time, and responses are swift and coordinated,” Barney added. “That balance of human expertise and technological capability turns cybersecurity from a reactive function into a true driver of resilience.”
Over time, cybersecurity professionals have shifted from individual operators to managers of machine labor. Previously, a strong analyst was measured by how well they could investigate an alert, write a detection or analyze an incident independently.
Increasingly, cyber professionals are measured by how effectively they can define objectives, provide the right context to a set of agents, evaluate results and decide what should happen next, said Aviv Nahum, co-founder and CEO at Above Security.
“I don’t think the answer is to artificially preserve every manual skill that AI can perform better,” Nahum told Dice. “We stopped expecting engineers to calculate everything by hand when calculators arrived. The same thing will happen in cybersecurity. If an agent can write a query, correlate telemetry or reconstruct an incident faster and better than a person, we should let it. The human value moves up a layer.”
At the same time, technical depth matters more than ever for cybersecurity professionals, especially as AI automates more routine tasks.
“You need enough understanding to know when an agent is wrong, what context it is missing and whether the result makes sense in the environment. But business context becomes equally important,” Nahum added. “The best security professionals will understand not only what happened technically, but why it matters to the company, which business process is involved and what response is proportionate.”
As sophisticated threats, cloud adoption, regulatory pressures and AI reshape security, workforce development and employee onboarding must become strategic priorities, said Ram Varadarajan, CEO of security firm Acalvio.
Although larger budgets are helping CISOs keep pace with AI, organizations must also make training resources accessible as AI becomes increasingly integral to security operations.
“The continued focus on AI, cloud, networking, risk management, administration and analysis highlights the need for cybersecurity professionals to combine technical, operational, and business skills,” Varadarajan told Dice. “Increasingly, they also need to understand emerging concepts such as AI-driven, game-theoretic cyber defense, which uses intelligent deception and adaptive strategies to shape attacker behavior.”
To overcome training and onboarding challenges, organizations should treat learning as a business requirement, with protected time and measurable goals.
“For those entering the field, the news is encouraging: employers are investing more in training and onboarding. However, candidates still need foundational IT, cloud, networking and AI skills to get hired and take advantage of those opportunities,” Varadarajan added.
Three Ways to Build More Resilient Cybersecurity Teams
According to Pax8’s Heddy, organizations must take fresh approaches to building cybersecurity teams, giving professionals enough time to develop the right skills and establish best practices for navigating technological changes such as AI.
Heddy offers three recommendations for organizations:
Build a continuous learning culture: Annual training cycles cannot keep pace with AI. Security teams need short, recurring, hands-on training that reinforces skills throughout the year, not just during compliance deadlines. The survey points toward growing interest in shorter, ongoing learning approaches that align with how practitioners retain knowledge.
Leverage partners as force multipliers: Organizations should not assume every emerging AI skill must be developed in-house. Managed service providers (MSPs), managed security service providers (MSSPs) and other cybersecurity partners can provide specialized expertise, accelerate adoption and help organizations maintain readiness while internal teams focus on strategic priorities.
Measure readiness, not certifications: The question isn't whether someone completed training. It's whether they can detect, investigate and respond to real-world threats. Organizations should regularly evaluate operational readiness through simulations, exercises and practical assessments rather than relying solely on course completion metrics.
“AI is creating more security work, not less. As threats become more sophisticated, organizations will need a combination of skilled employees, AI-powered tools, and trusted security partners to stay ahead,” Heddy told Dice. “The winners won't necessarily be the companies with the largest teams. They'll be the companies that can continuously learn, adapt, and tap into expertise wherever it exists.”
