Only 34% of cybersecurity professionals plan to stay with their current employer. That’s the headline from the 2026 IANS and Artico Search Cybersecurity Talent Report, released April 20, based on surveys of more than 500 security professionals across industries, roles, and seniority levels.

The inverse is more striking: two-thirds of the cybersecurity workforce is either actively looking or open to leaving. At a moment when 514,000 cybersecurity positions sit unfilled in the US alone, and when organizations are increasingly dependent on security programs that actually function, this is a structural problem — not a complaint to be dismissed with a comp adjustment.

The report’s findings push back on two common misconceptions: that money is the primary driver, and that the skills shortage is primarily a shortage of people. The real story is more specific and, for both employers and professionals, more actionable.

What the IANS Report Actually Shows

Compensation Matters — But It’s Not the Deciding Factor

The salary signal is real but conditional. There’s a 20-point satisfaction gap between professionals with stagnant wages and those who received even a modest increase:

  • 18% of employees with flat wages plan to stay — the lowest cohort
  • 42% of employees with 4–5% raises plan to stay
  • Even a modest raise signals to employees that the organization values their contribution

The data doesn’t say “pay people enough and they’ll stay.” It says that flat wages are a powerful signal that the organization doesn’t value the function — and that signal matters as much as the number itself. A 3% raise in an environment where security is clearly a priority reads differently than a 3% raise in an organization where the security team is constantly overruled.

The Real Drivers: Culture, Progression, and Flexibility

The report identifies three factors that consistently outperform compensation in explaining retention intentions:

1. Career progression visibility. Professionals who can’t see a clear path forward — to team lead, architect, director, CISO — disengage. This is particularly acute in organizations that treat security as a cost center rather than a function with strategic influence. There’s no natural advancement trajectory when the function has no strategic voice.

2. Organizational backing for security. This is the starkest number in the report: 73% of security professionals who perceive security as a core organizational priority report career satisfaction. Among those who don’t see that organizational backing, satisfaction drops to 19%. That’s a 54-point gap. No retention program compensates for a culture where security is routinely deprioritized.

3. Work flexibility. Hybrid arrangements — specifically one to two days onsite per week — deliver the strongest work-life balance outcomes in the data. Full remote and full onsite both score lower. The forced return to five days in the office is a documented retention risk in security specifically, where the talent market is tight enough that professionals can price that inconvenience into their next job search.

The Burnout Dimension

SANS’s 2026 skills crisis report adds a layer the IANS data implies but doesn’t fully surface: the AI knowledge gap is creating burnout through a different mechanism than workload alone. Security teams are now expected to defend against threats they don’t fully understand — AI-generated attacks, autonomous agents operating in their environments, shadow AI creating data exposure they can’t see — while simultaneously learning the tools needed to address those threats on the fly, often without training budgets or dedicated time.

An April piece from Intelligent CISO argued that the talent shortage narrative is wrong: the real crisis isn’t too few people, it’s that existing security professionals don’t have the AI literacy needed for the current threat landscape, and organizations aren’t investing in fixing that gap. The combination of new pressure and inadequate support is a burnout multiplier.

What CISOs and Security Leaders Should Do

1. Fix the Visibility Problem Before the Comp Problem

If professionals can’t articulate where their career is going at your organization in 12 and 24 months, they will eventually find an organization where they can. This requires actual succession thinking — not just performance reviews. Who is being developed for team lead? Who has the profile for principal engineer or director? Make it explicit.

2. Measure and Address the Culture Signal

Run the exercise: ask your team whether they believe the organization treats security as a core priority. If the honest answer from most of your team is “no,” no amount of salary adjustment will hold them. Address the organizational dynamics that produce that perception — starting with whether security findings get remediated, whether security input into product decisions is respected, and whether your team sees leadership visibly champion the function.

3. Don’t Flatten Wages in a Tight Market

The 18% retention rate among flat-wage employees tells a clear story. In a market with 514,000 unfilled positions and a 4.8 million global talent gap, flat wages communicate that you’re not competing for the talent — and your best performers are the ones most likely to test the market.

4. Build AI Literacy Budgets Explicitly

This is the retention investment that most organizations are missing. Security professionals who feel the organization is investing in their ability to handle new threats stay. Those who feel left to figure it out alone while being held responsible for outcomes they don’t have the tools to influence, leave. A meaningful AI literacy program — even 8–10 hours per quarter of structured learning time — signals that the organization is investing in the team’s ability to succeed.

What Professionals in the 66% Should Do

If you’re among the two-thirds not planning to stay, the market timing is real. Here’s how to use the leverage you have.

Understand Your Actual Market Value

The median cybersecurity salary reached $103,700 in 2026, but medians obscure wide variance. Threat intelligence analysts, cloud security architects, and AI security specialists are commanding significantly above median. Run a real market check: look at current postings in your specialization and geography, talk to recruiters, and understand what the market will pay for your specific skills. Don’t negotiate against your last salary — negotiate against market rate.

Make the Ask Before You Leave

Most professionals underestimate the cost of losing them. Hiring, onboarding, and ramp time for a security professional typically runs 1.5–2x annual salary in total cost. If you have a concrete competing offer or market data, that conversation is worth having before you sign elsewhere. You may not get what you want — and that answer tells you something — but the cost asymmetry is in your favor.

The Signals That Tell You to Leave

Not every retention situation is negotiable. Leave when:

  • Security is consistently deprioritized and you’re expected to manage the risk of that deprioritization without the authority to change it
  • There’s genuinely no advancement path — not “unclear,” but structurally absent
  • You’re being asked to operate in a threat environment you don’t have the tools or training to handle

The 66% who are open to leaving aren’t wrong to be open. In a market this tight, with a gap this large, there are real opportunities. The question is whether your current organization is worth giving the chance to compete for your retention — or whether the structural issues are ones that comp alone won’t fix.

For security leaders reading the IANS report: the 34% retention rate is a lagging indicator. It’s measuring what’s already true. The actions that move it are upstream: culture, progression visibility, organizational backing, and the investment signals that tell your team they’re worth developing. Those decisions happen now, not at the annual review.