Cybersecurity Skills Gap Widens as AI Integration Outpaces Organizational Readiness
Cybersecurity teams are grappling with a widening capability gap, as the rapid integration of AI, sophisticated identity-based attacks, and expanding digital operations create unprecedented complexity and scale in cyber risk. A new international survey by Barracuda Research reveals that organizations are struggling to develop the necessary skills, visibility, and governance frameworks to keep pace with these accelerating changes.
The findings suggest that the evolving cybersecurity landscape is less about sheer headcount and more about a broader 'capability' challenge encompassing expertise, technology, organizational approach, leadership, and resilience. Organizations are increasingly prioritizing enhanced visibility, trusted AI tools, and operational resilience over simply hiring more personnel. This signals a significant shift towards a cybersecurity profession that relies on a blend of human expertise, business acumen, and accountable oversight of increasingly autonomous technologies.
Skills Gaps Reflecting Evolving Threats
Almost all surveyed organizations (94%) report cybersecurity skills gaps, with a significant portion directly linked to the changing nature of cyberattacks. Specifically, 68% of organizations report skills gaps related to AI risks, including the capability to effectively counter AI-generated and highly targeted phishing or social engineering attempts. Concurrently, 67% report skills gaps in advanced identity and phishing threats, such as business email compromise (BEC), OAuth abuse, and multi-factor authentication (MFA) bypass techniques. The challenge extends to strategic leadership, with 61% citing skills gaps in areas like AI governance and translating technical risk into business impact.
As AI tools become more pervasive across business functions, they introduce new security and governance hurdles. 38% overall say they lack the skills needed to secure and govern AI tools used by the business, a figure that rises to nearly half of senior IT leaders. This indicates that many organizations are still in the early stages of developing the necessary skills, visibility, governance, and policy controls to manage business AI usage effectively. Furthermore, skills gaps are not confined to technical knowledge; 35% report a lack of expertise in incident-response speed and decision-making under pressure, and 32% struggle to translate technical risk into business impact, underscoring the growing need for judgment, communication, and business understanding alongside technical prowess.
Security Capability Versus Business Demand
The skills gap is exacerbated by a mismatch between organizational expectations of security functions and the available resources. Half of respondents (50%) state that security is expected to support new and expanding digital operations without additional resources. This pressure is compounded by 67% reporting that security teams are under pressure and struggling to scale, with nearly a third (32%) able to secure the business only reactively rather than proactively. This creates a detrimental cycle where expanding digital operations increase the attack surface, limited visibility and fragmented tools complicate security efforts, overstretched teams focus on immediate incidents, and the time for prevention, preparation, and skills development diminishes.
The Evolving Incident Response Model
When asked about managing cybersecurity more effectively, organizations prioritize improved visibility and trustworthy AI over additional headcount. Better visibility across identity, email, applications, networks, data, cloud services, and endpoints is the most frequently cited need, at 33%. Close behind, 32% want AI-assisted detection and investigation tools they can trust. This indicates a strategic move towards leveraging technology to augment human capabilities. The emerging model for incident response is heavily reliant on AI support, with 69% of organizations following a shared decision-making model where AI assists in processing information and recommending responses, but humans retain final judgment and decision-making authority.
AI's Impact on Security Roles and Headcount
Artificial intelligence is already reshaping security roles and headcount in most surveyed organizations, with 79% reporting an impact from AI. Over half (56%) have experienced workforce reductions due to AI, affecting both entry-level and higher-level security positions. This trend suggests that while AI automates routine tasks, it simultaneously elevates the demand for advanced professional expertise in areas such as AI governance, complex attack investigation, incident management, and high-consequence decision-making.
The cybersecurity profession is transitioning from a focus on discrete technical tasks to a more multifaceted role centered on judgment, orchestration, and accountability. As AI and automation increasingly handle routine analysis and recommendations, human roles will concentrate on interpreting subtle attacks, validating AI findings, making rapid decisions under pressure, coordinating responses, governing AI usage, and explaining technical risks in business terms. This evolution necessitates new pathways for career development and a broader skill set for senior security professionals, encompassing AI literacy, identity expertise, business continuity awareness, and communication skills.
