Security Budgets Are Rising in 2026. Training Budgets Are Shrinking. That's Backwards.
November 3, 2026
Randy Hall, CEO— AI-assisted and reviewed prior to publication.
Global information security spending is on track for a double-digit jump in 2026, yet fewer organizations are training existing staff into security roles than they were a year ago. The budget line that's actually growing is tools and platforms, not people. The gap the data says is driving risk, skills rather than seats, keeps widening because training is the first thing leadership cuts when a budget tightens.
Why Are Security Budgets Growing While the Skills Gap Gets Worse?
Security budgets are growing because leadership keeps buying software, not expertise, and the two problems don't solve each other. Gartner's 2026 forecast puts worldwide information security spending at $244 billion for the year, a constant-currency increase of 11.6 percent. That money is landing on top of a budget structure that already skews heavily toward platforms over people, with industry benchmarking showing roughly 40 percent of the average security budget going to software and platforms against 30 percent for internal personnel.
Meanwhile, the workforce data is telling a different story about where the actual risk sits. The 2025 ISC2 Cybersecurity Workforce Study found that cybersecurity budget cuts, layoffs, and hiring freezes have leveled off compared to the prior year, even as skill needs keep climbing. That's the disconnect: the money is flowing again, but it isn't flowing toward closing the gap the study says matters most.
What Is Actually Driving the 2025 Skills Shortage?
The shortage isn't a headcount problem anymore. It's a capability problem inside the teams organizations already have. Infosecurity Magazine's coverage of the ISC2 study reports that 59 percent of organizations now have critical or significant skills shortages, up from 44 percent the year before, and that skills shortages have overtaken headcount as the top factor undermining security effectiveness.
AI is the sharpest edge of that shortage. ISACA's most recent State of Cybersecurity research found that teams are striving to close gaps in large language model security operations, alongside soft skills, cloud computing, data security, and machine learning security operations. Separately, ISACA has reported that AI-driven threats are the top concern security professionals carry into 2026, which is exactly why the organization built its Advanced in AI Security Management credential as a layer on top of CISM rather than a standalone entry point. The shortage, in other words, is concentrated in exactly the areas a generic hiring push can't fix, because the people with that specific expertise barely exist in the open labor market yet.
The Training Pullback Nobody Budgeted For
Here's the part that should alarm a CFO more than the budget numbers do. Despite more than half of cybersecurity teams reporting they're understaffed, ISACA's State of Cybersecurity 2025 global findings show organizations are training fewer people into security roles than they did the year before, not more.
| Metric | Prior year | 2025 |
|---|---|---|
| Organizations with critical or significant skills shortages | 44% | 59% |
| Enterprises training non-security staff into security roles | 41% | 29% |
Read those two rows together and the strategy problem is obvious. The shortage is getting worse at the same time the one lever proven to address it, moving existing employees into security roles through structured training, is being used less, not more. That's not a budget constraint. Gartner's own numbers show the money exists. It's a prioritization choice, and right now it's the wrong one.
Where Should the Next Training Dollar Actually Go?
It should go toward certifying the people already inside the building, starting with the managers who decide how security work gets staffed and reviewed. ISC2's research backs this directly: Network World's reporting on the 2025 workforce study notes that nearly three-fourths of respondents believe reducing security personnel increases breach likelihood, which means the existing team's competence, not its size, is what boards should be underwriting.
For a security leader or an IT director building next year's case to the CFO, that argument is more persuasive than a headcount request. A structured credential like CISM certification prep gives a manager a defensible, externally validated baseline in governance, risk, incident response, and program oversight, the exact areas where ISACA's data shows adaptability and hands-on experience, not a four-year degree, are now the top hiring filters. It's a cheaper, faster way to close a capability gap than waiting months to fill an open requisition that may not get filled at all. If your team needs a clearer sense of what that preparation actually covers before committing budget to it, the curriculum overview and FAQ is the right place to start that conversation internally.
Building the Business Case Internally
Framing training as risk reduction, not professional development, is what gets it funded in a budget cycle that's already crowded with tool purchases. A few points carry weight in that conversation:
- Certification spend is a fixed, predictable cost against a hiring market where time to fill a technical role still runs months, and where the specific skills in shortest supply, AI security and cloud security, aren't reliably available to hire at any price.
- A certified existing employee carries institutional knowledge a new hire doesn't, which shortens the time between credential and measurable impact on the team's actual risk posture.
- Underwriters and auditors increasingly ask about staff qualifications directly, so documented training spend does double duty as both a capability investment and an evidence trail.
None of that requires cutting the tool budget. It requires treating training as a line item with the same scrutiny as a platform renewal, rather than the first thing trimmed when a budget gets tight. If you're the one building that plan for your team, you can start training now and have a credentialed manager in place before next year's audit or board review puts the question to you directly.
The Decision in Front of Leadership Right Now
The spending data and the workforce data are telling leadership two different things, and only one of them is being acted on. Budgets are growing. Tool purchases are growing with them. Training investment, the one input the workforce research directly ties to reduced risk, is shrinking in the same year the skills gap it's supposed to close hit a new high.
That's a strategy failure, not a budget failure. The money to fix it already exists in most 2026 plans. It just needs to be pointed at the people already on the team instead of the next platform renewal.