Cybersecurity Skills Gaps Grow as AI Reshapes Team Roles
The skills gap is becoming an operating problem
Cybersecurity teams are being asked to secure more systems and new AI capabilities while many lack the people and skills to keep pace. That mismatch changes the work itself: teams must cover a wider range of threats even as they struggle to staff the roles needed to assess them. The pressure is reshaping job requirements and pushing human specialists toward investigation, incident leadership and risk decisions. Those responsibilities require more than technical familiarity; they also call for judgment about what to investigate first and how a security issue affects the business.
Barracuda’s Cybersecurity Skills Gap report, based on a survey of 2,000 IT and security decision-makers, found that most respondents see gaps in their teams’ capabilities. AI-related risks were the most frequently cited challenge, at 68%, followed by advanced identity and phishing threats, at 67%. The figures suggest that teams are dealing with two pressures at once: new risks associated with AI and familiar attack methods that continue to demand close attention. The latter include business email compromise, OAuth abuse and multi-factor authentication bypass.
Two-thirds of respondents said their security teams are under pressure and struggling to scale with business needs. Half said those teams must support growing digital operations without additional resources. That combination leaves little room for teams to build new capabilities while keeping existing systems protected. The staffing picture is also shifting: 56% reported AI-linked reductions in security head count, divided evenly between entry-level and senior positions. The survey figures don’t establish why those reductions happened or how they affected security outcomes, but they underline the tension between adopting AI and maintaining enough human capacity to manage it.
As AI handles more routine analysis and response work, security professionals are moving toward threat investigation, incident leadership, automation oversight and business risk management. That shift depends on the quality of the systems and processes around the tools: automated output still needs to be checked, and incidents still require people who can set priorities and coordinate a response. “AI is changing the cybersecurity landscape faster than many security teams can build the necessary skills, visibility, and governance,” said Siroui Mushegian, Barracuda’s senior vice president and chief information officer. She said organizations need teams that pair AI and automation with human expertise and judgment. That’s a sensible description of the challenge, though the survey figures alone don’t show how well organizations are making that transition.
Demand is concentrating in specialist roles
Foundry’s forthcoming Security Priorities report points to the capabilities security leaders want to build. Cloud security topped the list at 35%, followed by securing agentic AI technology at 34% and AI- or machine learning-enabled technology at 30%. The close results indicate that leaders are planning for several technical demands at once, rather than treating AI security as a standalone task. Cloud security remains prominent, while the two AI categories point to work involving both the systems themselves and the tools built on them.
Finding qualified candidates remains difficult in the same areas. Cloud security architects, AI security specialists and forensics analysts were among the hardest cybersecurity roles to fill, according to the report. That gap puts teams in a bind: they need specialist knowledge to meet changing security demands, but recruiting for it is already challenging. And the role names suggest different needs within a security team, from designing cloud protections to examining incidents after they occur. A team that can’t fill those positions may have to spread specialist work across people already carrying other responsibilities.
For employers, the implication is practical. A list of desired skills doesn’t create the people who can apply them, and hiring alone may not close a gap if qualified candidates are hard to find. Teams also need to decide which capabilities they can build internally and where they need outside support. The reports don’t prescribe one answer, but together they show why security leaders are weighing skills, workload and business priorities at the same time.
Skills gaps carry operational costs
Pluralsight’s Tech Skills Report 2026 found that 41% of cybersecurity professionals in the UK estimate skills gaps cost their organizations at least £380,000 (US$500,000) a year. The estimate includes recruitment and outsourcing, lost revenue, abandoned projects and poorly maintained technology. It’s a broad accounting of costs, spanning immediate spending and work that doesn’t get done. Because it’s an estimate from respondents, it should be read as an indication of perceived impact rather than a precise bill for every organization.
A quarter of respondents said their organization had experienced security incidents or vulnerabilities in the previous 12 months because of skills gaps. Another 43% said those gaps commonly lead to cybersecurity projects being abandoned. The findings show how limited expertise can affect both day-to-day defenses and longer-term work. When teams lack the people to assess a weakness or carry a project through, the consequences can extend beyond a delayed task: existing exposure may remain, while planned improvements wait for capacity. The survey doesn’t identify which projects were abandoned or explain the causes in individual cases, so the numbers describe the scale of concern rather than its details.
This is more significant than it looks: the cost of a skills shortage isn’t limited to recruitment. A team can spend money to bring in outside help and still lose time on projects that stall, or struggle to maintain technology it already depends on. If you’re working in this space, the useful question is whether skills gaps are visible in operational plans and incident reviews, not just in hiring targets. (And this is the part most people overlook.)
AI skills are spreading through job listings
Research from the AI Workforce Consortium estimates that Europe lacks more than 300,000 cybersecurity professionals. Across G7 countries, cybersecurity job postings that require AI skills have doubled year over year. The increase is especially pronounced in senior roles, where postings requiring AI skills rose 65%, compared with 5.9% for junior roles. That difference points to a particular demand for experienced workers who can apply AI knowledge in security settings. It doesn’t, by itself, tell us how many hires were made or whether applicants had the skills employers sought.
The consortium, an industry group backed by Cisco, Google, Microsoft, IBM, SAP and others, also points to demand for practical experience and human skills. As AI becomes part of security operations, teams will need people who can assess its output, lead responses and connect technical findings to business risk. That combination matters because a tool can flag activity without deciding what deserves immediate attention or how a response should be coordinated. The human work is changing, but it hasn’t disappeared.
The findings also raise a workforce question: if AI-related requirements are growing faster in senior postings than in junior ones, organizations may need a way to develop those capabilities among existing staff. The available figures don’t show whether employers are investing in training or relying on outside recruitment, so the answer remains open. That said, a hiring strategy built only around experienced specialists may be hard to sustain when reports already describe shortages and difficulty filling key roles.
What the findings mean for security teams
Taken together, the reports describe a cycle that’s difficult to break: organizations want more specialist skills, but qualified candidates are hard to find; teams are under pressure, and gaps can delay projects or contribute to security incidents. AI may absorb some routine work, but it also adds demands around oversight, investigation and risk decisions. The numbers here are underwhelming as a measure of what AI has already fixed: the cited findings show rising demand and staffing pressure, not proof that automation has resolved the underlying shortage.
For security leaders, the near-term task is to connect skills plans to the work teams actually need to do. That means identifying where specialist knowledge is missing, which responsibilities can be supported by automation, and where human review remains necessary. The reports don’t offer a single formula, and their surveys can’t settle how each organization should staff its team. But they make one point plain: adopting AI doesn’t remove the need for people who can judge its output and act on the risks it surfaces. A staffing plan has to account for both.
More demand. More responsibility. And a persistent shortage of people with the right experience.
