The cybersecurity industry has spent years framing its workforce challenge as a talent shortage. The numbers support that view. Nearly half of cybersecurity positions globally remain unfilled and demand continues to outpace supply.
The shortage, however, is becoming an increasingly incomplete explanation.
Accenture’s analysis of more than 550,000 cybersecurity job postings and professional profiles suggests organisations are no longer struggling simply because there are too few cybersecurity professionals. They are struggling because the jobs themselves have changed faster than the talent pipeline designed to fill them.
Almost six in ten cybersecurity vacancies now demand a combination of technical expertise, business understanding, leadership and emerging technology skills. Only about four in ten professionals currently possess that blend.
The labour market is producing specialists. Organisations increasingly need integrators.
Technical expertise is no longer enough
For most of the past two decades, cybersecurity success depended on technical depth. That work remains essential. What has changed is everything around it.
Cybersecurity has moved from the IT department into boardrooms, mergers, product development, cloud migration, AI deployment and enterprise transformation. Security professionals are now expected to influence investment decisions, explain complex risks to executives, collaborate with business leaders and shape organisational strategy.
Those expectations require a different mix of capabilities.
Accenture’s analysis shows leadership and business capabilities now occupy far more space in cybersecurity job requirements than they once did. In product management roles, strategic and leadership skills outweigh purely technical ones.
The profession has evolved faster than its talent model.
Education is still preparing yesterday’s workforce
That mismatch begins long before recruitment.
Accenture reviewed cybersecurity programmes across 24 countries and found recurring gaps in areas such as governance, enterprise risk, cyber law and executive communication.
Graduates leave with strong technical foundations but often limited exposure to the commercial realities in which cybersecurity decisions are made.
Organisations then attempt to bridge that gap through recruitment.
The difficulty is that they are all competing for the same relatively small pool of experienced professionals who have already acquired those broader capabilities through years of practice.
Hiring becomes expensive because organisations are no longer competing for technical skills alone. They are competing for judgement, business context and experience, qualities that take years rather than months to develop.
The hidden cost of burnout
Vacancy numbers tell only part of the story.
The people already doing cybersecurity work are leaving more quickly than before.
Average cybersecurity job tenure has fallen from 3.3 years during 2005 to 2015 to just 1.8 years over the past decade. More than half of cybersecurity professionals report frequent work-related stress, while one in five is considering leaving the profession altogether.
Replacing experienced cybersecurity professionals is difficult. Replacing their judgement is harder.
Every departure removes not only technical knowledge but also an understanding of how the organisation operates, where its risks lie and how security decisions interact with business priorities.
That institutional knowledge cannot simply be recruited back from the market.
AI is widening the gap
Artificial intelligence has added another layer of complexity.
Demand for AI-related cybersecurity skills has more than doubled since 2020. Ninety-four per cent of cybersecurity leaders expect AI to be the biggest driver of change in the field. Eighty-seven per cent identify AI vulnerabilities as the fastest-growing risk category.
The challenge is not merely learning another technology. It is learning how to govern technologies whose capabilities evolve in weeks while workforce development cycles operate in years.
Organisations can purchase AI tools almost immediately. Developing professionals capable of managing the risks those tools introduce takes considerably longer.
The timelines simply do not match.
Why this matters for HR
The report’s implications extend well beyond cybersecurity.
Many organisations still approach talent shortages as recruitment problems. When demand rises, the instinct is to advertise more vacancies, increase salaries and compete harder for external candidates.
That approach works only when the required capability already exists in the labour market.
Increasingly, it does not.
Cybersecurity may simply be the first profession where this broader shift has become impossible to ignore.
The skills employers value most are becoming combinations rather than specialisations.
Technical expertise remains essential, but it is no longer sufficient. Business judgement, communication, leadership and the ability to work across functions have become equally valuable.
Those capabilities develop through deliberate career design, not recruitment campaigns.
The India opportunity
India sits in an unusual position.
The country produces one of the world’s largest pools of technically trained graduates, yet organisations continue to report shortages of experienced cybersecurity professionals capable of operating at enterprise level.
The gap is not one of education alone. It is one of progression.
Moving from technical competence to strategic influence requires exposure to governance, risk management, business decision-making and cross-functional leadership. Those experiences are rarely built systematically into career pathways.
As cyber threats become more sophisticated and AI reshapes both attack methods and defence strategies, organisations may find that their biggest competitive advantage is no longer attracting cybersecurity talent. It is developing it.
That makes cybersecurity less of a hiring challenge than a workforce design challenge.
Beyond cybersecurity
The market can no longer supply every capability organisations need.
Increasingly, organisations will have to build those capabilities themselves.
Cybersecurity happens to be confronting that reality first. It is unlikely to be the last.