Two-Thirds of Security Leaders Say Their Teams Are Falling Behind

Key points

• Cybersecurity job postings requiring AI skills doubled year-over-year across G7 countries, according to the AI Workforce Consortium's new spotlight report.
• 67% of 2,000 IT and security decision-makers surveyed by Barracuda say their teams are struggling to scale to meet business needs.
• 56% of Barracuda respondents report a reduction in security headcount tied to AI, distributed evenly across entry-level and senior roles.
• UK cybersecurity professionals estimate that skills gaps cost their organisations at least £380,000 (roughly US$500,000) per year, per Pluralsight's Tech Skills Report 2026.
• Europe is currently short of more than 300,000 cybersecurity professionals, the AI Workforce Consortium found.

Security teams are shrinking. The attacks they face are getting harder, and the skills employers now need most barely registered as mainstream job requirements three years ago. Several pieces of workforce research, landing within weeks of each other, make this difficult to frame as a gradual problem.

Security vendor Barracuda surveyed 2,000 IT and security decision-makers and found the vast majority reporting cybersecurity skills gaps inside their organisations. The two most common trouble spots: AI-related risks, flagged by 68% of respondents, and advanced identity and phishing threats, cited by 67%. Those identity threats include business email compromise (where criminals impersonate executives or suppliers to redirect payments), OAuth abuse (where attackers hijack the trusted sign-in systems that let one app speak to another), and MFA bypass, meaning tricking or forcing past the second verification step that is supposed to stop stolen passwords from being enough.

Half of Barracuda's respondents say their security professionals are expected to support growing digital operations with no additional resources. More than half report headcount cuts tied to AI. That last figure is worth sitting with: the tool being introduced to fill the gap is simultaneously being used to justify cutting the people who would use it.

What is the skills gap actually costing?

Real money. UK cybersecurity professionals estimate the annual cost per organisation at £380,000, a figure that covers hiring and outsourcing spend, lost revenue, abandoned projects, and poorly maintained technology, according to Pluralsight's Tech Skills Report 2026. A quarter of those professionals say their organisation experienced a security incident or vulnerability in the past twelve months because of skills gaps. Nearly half (43%) say skills gaps are a common reason their organisations abandon cybersecurity projects outright.

The AI Workforce Consortium, an industry group backed by Cisco alongside Google, Microsoft, IBM, SAP and others, put a structural number on the European shortfall: more than 300,000 unfilled cybersecurity positions. Its new report, "AI Agents and the Impact on Cybersecurity," is the first in a planned series tracking where AI is changing the workforce fastest. Senior roles requiring AI skills rose 65% year-over-year across G7 countries. Junior roles requiring the same skills rose only 5.9%. The gap matters because it signals that the market wants experienced practitioners who already understand AI, not entry-level candidates who can learn on the job.

Should you worry if you work in security?

Our earlier piece "AI Rewired Software Development. Cybersecurity Is Next, But Not in the Same Way" argued the shift would be real but slower and stranger than what happened to software engineering. This research supports that read. As AI handles routine log-sorting and alert triage, human roles move toward threat investigation, incident leadership, and business risk management. CSO Online reported separately that cloud security architects and AI security specialists are among the hardest positions to fill right now. Retraining toward those roles, rather than waiting to be displaced from more routine ones, is the practical response the data implies.

For customers and patients whose data sits inside organisations feeling these pressures, the immediate steps are modest: refresh passwords on sensitive accounts, watch for unexpected login notifications, and treat any email requesting a payment approval or credential reset with extra scepticism.

The picture here is less a shortage story than a mismatch story. Cybersecurity has people. It doesn't have enough of them who know how to work alongside AI systems yet, and the organisations best placed to fund that retraining are often the same ones cutting budgets to pay for the AI tools driving the demand.