If you have spent 2026 reading cybersecurity workforce research, you have encountered two incompatible claims, often in the same week.
The first: the industry faces a catastrophic shortage — roughly 700,000 unfilled positions in the United States, a persistent global gap, and organizations unable to staff their security functions.
The second: 38% of organizations froze hiring and 25% conducted layoffs. Budget has overtaken talent availability as the number one barrier, with 37% of organizations cutting security budgets. High-profile reductions at security vendors have put experienced practitioners into a market where they compete directly with juniors. And an analysis published August 11, 2026 found only 318 entry-level roles across 5,260 US security openings — about six percent.
Job seekers reading both conclude that someone is lying. Nobody is. The two claims describe different things, and understanding the difference is the most useful career analysis available right now.
Reconciling the Contradiction
The shortage is a shortage of experienced specialists, and it always was. The 700,000 figure aggregates every unfilled security role. The overwhelming majority of those roles require five to ten years of experience in a specific domain — cloud security architecture, OT security, detection engineering, application security, identity. There is no shortage of people who want to enter the field. There is an acute shortage of people who can run a Kubernetes security program or reverse a firmware image.
A gap in demand is not a gap in funded demand. “Unfilled position” in most survey methodologies means work that needs doing, not a requisition with money attached. When 37% of organizations cut budgets, the work does not disappear — it becomes an unfilled need that no one is permitted to hire for. The shortage statistics and the hiring freeze statistics are measuring the same underdinvestment from two directions.
Seniority compression is the mechanism. With fewer slots, hiring managers optimize for immediate productivity. An experienced hire is lower-risk: shorter ramp, no mentoring overhead, no supervision cost. When a team can hire one person instead of three, that person is senior. The entry-level roles do not get filled by someone else; they cease to exist as a category.
Layoffs at security companies made it worse in a specific way. Reductions at established vendors released experienced practitioners into the market, and some of them applied for roles well below their prior level. A junior candidate is now not competing with other juniors. They are competing with someone who has eight years of experience and a mortgage.
AI is genuinely changing the shape of junior work, and honesty is warranted here. Tier-one alert triage, log review, initial phishing analysis, first-pass vulnerability report writing — the tasks that constituted an entry-level security job — are substantially automatable and are being automated. This does not eliminate the need for junior people. It eliminates the training ground that produced senior people, which is a slower and more serious problem than a hiring dip. We covered the underlying dynamic in how AI amplifies rather than replaces security roles; the amplification is real, and so is the removal of the bottom rung.
Where Demand Is Actually Growing
The picture is not uniformly bleak, and the growth areas are specific.
AI governance and oversight. Fortinet’s 2026 research found 63% of organizations expect increased need for AI oversight and governance roles on security teams over the next three years. This is one of the few areas where headcount requests are being approved, driven by the EU AI Act’s enforcement phase and comparable pressure elsewhere. Regulation creates funded roles in a way that risk alone does not.
Detection engineering. As CISA’s two-SOC comparison demonstrated this week, detection capability rather than preventive tooling is what determines outcomes. Organizations are shifting spend accordingly, from analyst headcount toward engineering headcount.
OT and ICS security. Threat activity, regulation, and now trade policy on grid equipment are converging on a practitioner cohort that is small and aging. This is the clearest supply-demand imbalance in the field.
Identity security. Every significant incident pattern of the past two years routes through identity. The specialization is deep, conceptual, and consistently underfilled.
Cloud and application security at senior levels. Perennially short, and the shortage is real rather than budgetary.
The pattern: specialized, consequential, hard to automate, and connected to either a regulatory driver or a demonstrated loss event. Roles that are generalist, process-oriented, or primarily about volume are contracting.
What This Means for Security Leaders
Recognize that eliminating entry-level hiring is a decision with a five-year cost. The senior specialists you cannot find in 2031 are the juniors nobody hired in 2026. This is a collective action problem — no single organization’s junior hiring meaningfully changes the market — but it is also a specific, avoidable failure at the level of your own succession planning. If your team has no one below three years of experience, you have outsourced your future hiring to a market that will not have what you need.
Redesign the junior role around what AI does not do. The old entry-level job was volume work, and volume work is gone. The new one should be built around judgment development: shadowing investigations, tuning detections under supervision, running the parts of a purple team exercise that require asking questions. This is more expensive per head and produces better practitioners faster. It requires admitting that a junior hire is a training investment rather than a productivity add, which is the conversation most organizations avoid.
Invest in the people you have, because they are cheaper than the people you cannot afford. The 2026 SANS/GIAC workforce research made the point bluntly: the bigger problem is not headcount but that existing staff lack the skills current threats demand, starting with AI. Fortinet found 92% of organizations would pay for employee security certifications, up from 73%. Training budget is not a benefit — under a hiring freeze, it is your only path to new capability.
Take retention seriously, because the numbers are alarming. Only 34% of surveyed security professionals plan to remain with their current employer over the next year. In a market where hiring is frozen, every departure is an unbackfillable loss. Retention is now cheaper than recruitment by a wider margin than at any point in recent memory, and the levers are known: growth paths, training, reasonable on-call, and managers who are not themselves burning out. We wrote about this in the talent retention crisis and nothing since has improved it.
Make the budget argument with breach economics, because it is available. 86% of organizations experienced breaches in the past twelve months; 52% report breaches costing more than $1 million. Insufficient investment in security talent is repeatedly identified among the leading causes. That is the argument to bring to a board that is cutting security budget — not the shortage statistics, which sound like an industry complaining about itself.
The Careers Angle
For anyone trying to enter or move within the field right now, the honest guidance is different from what it was two years ago.
Do not aim at “cybersecurity.” Aim at a specialization with a funded driver. AI governance, detection engineering, OT security, identity, cloud security. Generic security roles are the most contested and the least funded. Specialized roles have fewer applicants and clearer budget justification behind them.
The adjacent-entry path is now the main path. Very few people enter security directly at the moment. They enter through IT operations, software engineering, data analysis, network engineering, compliance, or — in OT specifically — through industrial engineering. Then they specialize. If you are already in one of those functions, that is an advantage rather than a detour, and the crossover is the shortest route available.
Demonstrated work substitutes for credentials in a way it did not used to. With more applicants than roles, certifications are a filter rather than a differentiator. What differentiates is evidence: a home lab with real detections, a published tool, a CTF record, a documented project. Employers can verify those in minutes. Build the proof-of-work portfolio — it is the highest-return use of a job seeker’s time right now.
Get your employer to fund your certifications, because they will. Ninety-two percent said they would pay. Most employees never ask.
Take the unglamorous sector. Water utilities, hospital systems, school districts, manufacturers, mid-market companies. Less competition, more responsibility earlier, and — as CISA’s comparison of a water utility against a government services organization showed this week — the work is often better than the prestige suggests. Two years running security somewhere constrained builds more judgment than five years as a specialist cog in a large program.
If you are already employed in security, this is a bad market to leave voluntarily and a good one to grow inside. Take the training. Take the project nobody wants. Move toward one of the growth specializations from within, where the internal transfer is far easier than the external hire.
The Bottom Line
The cybersecurity workforce narrative needs updating. “Massive shortage, come on in” was accurate enough in 2019 and it is misleading in 2026. What is true now is narrower and more useful: there is severe, funded demand for experienced specialists in a handful of domains, and there is very little room for generalists at the entry level.
That is a harder message, and it is a better one to plan against. The people who do well over the next two years will be the ones who picked a specialization with a real driver behind it, built visible evidence of competence, and entered through an adjacent door rather than waiting for a front door that currently has 318 openings behind it.
And the organizations that do well will be the ones that noticed the bottom rung disappearing and rebuilt it anyway — because in five years, everyone will be hiring from a cohort that only exists if someone trains it now.
Sources: Fortinet 2026 Global Cybersecurity Skills Gap Report; SANS Institute — “The Cybersecurity Talent Shortage Narrative Is Wrong. The Real Crisis Is What Your Team Doesn’t Know, Starting with AI” (2026 SANS | GIAC Cybersecurity Workforce Research Report); BigDogJobs — “Entry-Level Cybersecurity Jobs: Scarcity in August 2026” (August 11, 2026); StationX — “Cybersecurity Job Market Statistics and Trends [2026]” and “Cybersecurity Skills Gap Statistics [2026]”; Programs.com — “Cybersecurity Talent & Workforce Shortage Stats (2026)”; SpectraForce — “Cybersecurity Talent Shortage: What It Means for U.S. Employers in 2026.”
This article is provided for informational purposes only and reflects survey data and reporting available as of August 28, 2026. Workforce statistics from different sources use differing methodologies and are not directly comparable; figures should be read as directional rather than precise.
