Time to read: 7 minutes
Short Summary
Organizations depend on digital systems for communication, finance, customer information, cloud computing, and daily operations, yet finding people with the right cybersecurity skills remains a challenge. The issue is more complex than simply having too few workers. Employers need professionals who can investigate incidents, manage risk, secure cloud environments, understand networks and identities, and apply technical knowledge in real situations. Even as artificial intelligence automates parts of cybersecurity, trained professionals remain essential.
Introduction
Cybersecurity is becoming more automated. Artificial intelligence can analyze alerts, identify unusual behaviour, summarize incidents, search enormous datasets, and assist security teams with investigations. It might therefore seem reasonable to assume that organizations will eventually need fewer cybersecurity professionals.
Current workforce research suggests a more complicated picture.
ISC2's 2025 Cybersecurity Workforce Study estimated a global cybersecurity workforce of approximately 5.5 million people while identifying a workforce gap of roughly 4.8 million. Importantly, ISC2 explains that this gap is “not the same as the number of current job openings”. It represents the difference between the cybersecurity resources organizations have and what respondents believe they need to secure themselves effectively.
The challenge is therefore not simply finding more people. It is developing people with the right skills.
The Skills Gap Is More Than a Headcount Problem
A company can employ a security team and still lack important capabilities.
It may need people with stronger knowledge of cloud security, incident response, identity management, application security, threat detection, artificial intelligence, or risk management.
ISC2's workforce research has increasingly emphasized this distinction between a “workforce gap and a skills gap”. Organizations may struggle because they lack expertise even when security positions are already staffed.
That distinction matters for students. Entering cybersecurity is not simply about obtaining a job title. It is about developing capabilities organizations can use.
Cybersecurity Keeps Expanding
The environment cybersecurity professionals protect has changed dramatically. Security once focused heavily on computers operating inside an organization's network. Modern organizations may use cloud infrastructure, software-as-a-service applications, remote workers, mobile devices, APIs, connected devices, third-party suppliers, and AI systems. Each additional technology can create new security considerations.
The World Economic Forum's Global Cybersecurity Outlook 2026 reports that rapid AI adoption, geopolitical uncertainty, increasingly complex supply chains, and cyber-enabled fraud are reshaping the cybersecurity landscape. It also identifies cyber skills and talent shortages as continuing concerns for organizations.
Cybersecurity therefore does not remain static. Professionals must continue learning because the environment they protect continues changing.
AI Changes Skills Rather Than Eliminating Them
Artificial intelligence can automate repetitive work. That can be valuable.
A security analyst may no longer need to spend as much time manually collecting information from numerous systems or reviewing every low-priority alert. But automation creates new responsibilities.
Someone must configure the systems, evaluate their output, investigate uncertain situations, manage permissions, recognize incorrect conclusions, and decide what action should be taken.
AI systems themselves also create security risks.
As organizations connect AI agents to sensitive information and business systems, cybersecurity teams need to understand issues such as access control, data exposure, prompt injection, model manipulation, and agent permissions.
The World Economic Forum reports that AI-related vulnerabilities were the fastest-growing cyber risk during 2025, with 87% of surveyed respondents identifying them as the fastest-growing risk during that year.
Employers Need Practical Capability
Cybersecurity is an applied discipline. Knowing terminology is not enough.
An analyst may need to examine logs, investigate suspicious authentication, understand network traffic, analyze endpoint behaviour, identify vulnerabilities, document incidents, configure security controls, or explain technical risks to someone without a technical background.
This is why practical training matters. Students need opportunities to apply concepts rather than simply memorize them. A networking concept becomes more meaningful when a student examines traffic. An incident-response process becomes clearer when the student must investigate an event. Identity security becomes more understandable when students work with permissions and authentication. Technical knowledge becomes professional capability through application.
Communication Is a Cybersecurity Skill
Not every important cybersecurity skill involves a command line. Security professionals also communicate.
An analyst may discover a serious vulnerability but still need to explain its importance to management. An incident responder may need to document what happened. A security team may need to convince employees to change unsafe behaviour. A technical specialist may need to work with developers, cloud engineers, legal teams, executives, or customers.
The World Economic Forum emphasizes collaboration between technical teams, leadership, government, and other stakeholders as cyber risks become increasingly interconnected.
Technical expertise remains essential. The ability to communicate that expertise makes it more useful.
Entry-Level Does Not Mean Finished Learning
Cybersecurity students should also understand that graduation is not the end of training.
- Technology changes too quickly.
- Cloud platforms evolve.
- Attack techniques change.
- Security products gain new capabilities.
- Artificial intelligence creates new workflows.
- Regulations and organizational risks change.
A cybersecurity professional therefore needs the ability to continue learning throughout a career. This can involve certifications, professional development, labs, independent research, industry events, documentation, and continued practical experience.
The goal of education should not be to teach every tool a student will ever use. That would be impossible.
A stronger objective is to develop the technical foundations and problem-solving ability required to learn the next tool.
Different Skills Create Different Career Paths
Cybersecurity is also broader than one occupation.
Professionals may work in security operations, incident response, penetration testing, vulnerability management, cloud security, identity and access management, governance, risk, compliance, digital forensics, application security, threat intelligence, or security engineering.
These areas overlap, but they require different combinations of skills. Students do not necessarily need to know their entire career path immediately. They should develop broad foundations and then discover where their strengths and interests fit.
Networking, operating systems, scripting, cloud concepts, security principles, troubleshooting, communication, and analytical thinking can support many directions.
What This Means for Cybersecurity Students
Students should focus on becoming capable rather than simply becoming credentialed.
- Build technical foundations.
- Practice troubleshooting.
- Work with realistic scenarios.
- Learn how systems interact.
- Understand why security controls exist.
- Develop communication skills.
- Become comfortable investigating situations where the answer is not immediately obvious.
- Most importantly, remain curious.
Cybersecurity rewards people who keep asking questions.
Conclusion
The cybersecurity skills gap is not simply a story about empty positions. It reflects a deeper challenge.
Organizations increasingly depend on complex digital environments while threats, technologies, and responsibilities continue evolving.
Artificial intelligence will automate parts of cybersecurity, but automation does not remove the need for expertise. It changes where expertise is applied.
Organizations still need people who can investigate, interpret, communicate, question, and make decisions when technology alone cannot determine the correct response.
For cybersecurity students, that creates both an opportunity and a responsibility. The goal is not merely to enter a growing field.
It is to develop the skills that make you useful when an organization needs someone who understands what is happening, why it matters, and what should happen next.
Your Cybersecurity Career Starts Here
To learn more about our LEA.DU: Computer Security Analyst program and how you can apply, visit the program page.
References
- ISC2 — 2025 Cybersecurity Workforce Study
- ISC2 — Cybersecurity Workforce and Skills Gap Research
- World Economic Forum — Global Cybersecurity Outlook 2026
- World Economic Forum — Global Cybersecurity Outlook 2026: Key Findings
- Microsoft Security — Security Operations and AI Research, 2026
- Google Cloud / Mandiant — Cybersecurity and AI Risk Research, 2026
The blog is written by the Cybersecurity team at Trebas Institute Quebec Inc.
