ISC2 Retired the 4.8 Million Jobs-Gap Number. The Replacement Points Straight at AI.
October 21, 2026
Jillian, CMO— AI-assisted and reviewed prior to publication.
For the first time in its history, ISC2's annual workforce study did not publish a global cybersecurity jobs-gap number. In its place is a ranked list of missing skills, with AI at the top, cited by 41 percent of respondents as their most pressing need. If you are building a career case right now, that substitution matters more than the missing headline figure ever did.
Why Did ISC2 Stop Publishing a Global Workforce Gap Number?
ISC2 stopped reporting the figure because its own survey respondents told them headcount was no longer the real constraint. The 2025 ISC2 Cybersecurity Workforce Study, based on more than 16,000 professionals, found that organizations increasingly believe adding people without the right capabilities does not fix their security posture.
This is a real reversal from how the study has framed the problem for years. As Infosecurity Magazine reported, ISC2 noted that the need for critical skills within the workforce is now outweighing the need to increase headcount, a shift significant enough that the organization chose to retire the metric rather than publish a number it no longer believed told the right story. Staffing itself even improved slightly, with the share of respondents reporting the right number of staff climbing year over year, which makes the skills story harder to wave away as just another version of "we need more hands."
What Skill Is Actually Missing From Cybersecurity Teams?
AI leads the list, named by 41 percent of respondents as the most pressing skills need, ahead of cloud security at 36 percent and several other core disciplines trailing behind. Network World's coverage of the study frames this plainly: cybersecurity teams are navigating skills shortages overtaking headcount as the primary concern as professionals adopt AI tools faster than their organizations can train for them.
| Skill area | Share citing it as a top need |
|---|---|
| AI | 41% |
| Cloud security | 36% |
| Risk assessment | 29% |
| Application security | 28% |
| Security engineering / GRC | 27% |
Two years ago, AI was not even on the radar as a required skill set for security roles. ISC2's own CISO, Jon France, told IBM's analysis of the study that AI has moved into the top five skills and that it could plausibly become the single most in-demand skill set in security within the following year. That prediction is now playing out in the data.
The Cost of Treating This as a Hiring Problem
Teams that keep approaching this as a staffing shortage rather than a capability shortage are absorbing real consequences. The same ISC2 study found that a large majority of organizations experienced at least one significant cybersecurity consequence in the past year tied directly to a skills gap, with many reporting more than one such incident. That is not an abstract workforce statistic. It is breach exposure, slower detection, and compliance findings that trace back to a team that had enough people but not enough of the right depth.
This is also why budget conversations in security are shifting shape rather than shrinking outright. Money that used to fund an additional analyst headcount is increasingly funding targeted upskilling instead, because a team of the same size with AI-specific depth outperforms a larger team without it. If you want a study plan built around closing that specific gap rather than generic security review, you can start training whenever you is ready to commit the hours.
What Are Employers Actually Screening For When They Say "AI Skills"?
Employers are not screening for whether you have used a chatbot. They are screening for whether you can explain how AI changes risk in your specific role and back that up with something concrete. Dice's reporting on what hiring and HR managers want in 2026 quotes a hiring source saying employers value candidates who can articulate concerns such as data leakage, model hallucinations, and prompt injection, and that simply naming a tool without context signals surface familiarity rather than competence.
That bar shows up consistently across hiring conversations right now. Three things tend to separate a candidate who gets a second interview from one who gets screened out:
- Specific language about AI failure modes (prompt injection, data leakage, model drift) rather than vague claims of being "AI-savvy"
- A concrete example of monitoring, hardening, or testing an AI-involved workflow, not just describing one in the abstract
- The ability to connect an AI risk to a governance or compliance consequence, not just a technical one
Claiming to be an AI expert without a way to demonstrate it is, if anything, a worse signal than saying nothing at all, because it invites a technical screen you cannot pass.
Does a Certification Actually Close This Gap?
A certification helps when it maps directly to the capability employers say they are missing, rather than to AI in general terms. CompTIA built its newest credential for exactly this reason. According to CompTIA's own announcement of the certification, the company's chief product officer said that as AI expands into core business processes, the ability to secure AI systems, manage AI-related risk, and support responsible AI governance has become a defining capability for modern security roles.
That credential is CompTIA SecAI+, and its structure tracks the actual gap ISC2 identified rather than a generic AI overview. Per CompTIA's own FAQ on the exam, it is an expansion certification built to extend an existing security foundation, with domain weighting concentrated on securing AI systems and on AI governance, risk, and compliance rather than on AI theory. It is designed to sit on top of Security+ or CySA+, which matters if you are deciding where to invest study time this year rather than starting your security career from zero. If you are weighing that sequencing decision, the curriculum overview and FAQ on study paths is a reasonable place to check prerequisites before you commit to an exam date.
What This Means for Your Next Move
The practical takeaway is not that you need to rebrand yourself as an AI specialist. It is that the specific, narrow claim "I can secure AI systems and explain the governance tradeoffs" now outweighs a broader claim of general security experience when a hiring manager is comparing two resumes. ISC2 retiring its headline number was an admission that counting people stopped being useful. Counting capabilities is what replaced it, and that is the metric worth optimizing your next year of study around.