Cybersecurity Workforce Statistics (2026): Skills Gaps, Staffing Strain & Job Demand
2026 cybersecurity workforce data: skills gaps, understaffing, BLS job growth, CyberSeek openings and what the nonprofit staffing squeeze means for volunteer programs.
On this page
The cybersecurity workforce is no longer defined mainly by how many people are missing. The most recent global survey data shows that the sharper problem is skills: whether teams have the specific capabilities to handle cloud, AI, identity and risk work. Demand for US security talent is still climbing, federal projections point to strong growth through 2035, and smaller organizations, including nonprofits, feel the squeeze most. This report pulls together the primary and widely cited sources behind those numbers. It is part of our statistics hub, and we refresh it yearly.
Key takeaways
How big is the workforce, and why the headcount number went quiet
ISC2's long-running survey has been the reference point for global headcount. Its 2025 edition collected responses from 16,029 professionals and, for the first time, dropped its annual workforce gap estimate. The prior edition had tallied a gap of 4.8 million professionals. Because that 2024 figure is the last published estimate, it remains the most-cited global number, but it is not a 2025 measurement.
Why the change? ISC2 says respondents kept pointing to specific skills needs rather than to a simple shortage of bodies. Several secondary write-ups of the study describe the same shift, and the ISC2 focus report ties resilience to agility and continual skill development rather than raw headcount.
Skills gaps have overtaken headcount as the main risk
The clearest shift in the 2025 data is the rise in serious skills gaps. The share of teams reporting critical or significant skills needs rose to 59%, from 44% a year earlier. The ISC2 figures also link these gaps to operational harm. Its 88% figure captures respondents reporting at least one significant consequence in the past year because of a skills shortage.
Which skills are in short supply
Skills demand is concentrated in a handful of areas. The most-named need in ISC2's 2025 results is AI, followed by cloud security. Security governance and risk work also ranks high. The list below comes from a compiled table that attributes its figures to the ISC2 2025 study; check the ISC2 report for the primary text. ISC2 also notes that cloud architecture, AI fluency, secure design and identity governance are becoming baseline skills rather than specialties, according to Enterprise Security Tech's coverage.
Stress, understaffing and retention
ISACA's 2026 State of Cybersecurity survey, which gathered responses from more than 1,800 professionals, adds a day-to-day view. Most respondents describe their roles as more stressful than five years ago, and the leading cause is a threat landscape they see as increasingly complex. Staffing is part of the strain: the same report finds that many organizations believe their teams are too small and that retaining qualified staff is hard.
Job demand: federal projections and the openings count
The US Bureau of Labor Statistics is the most authoritative projection source. It expects information security analyst employment to grow 21 percent from 2025 to 2035, which is much faster than the average for all occupations. Its published average for all occupations is 3 percent over the same decade. The BLS 2024–34 projections had already flagged the occupation as the fastest-growing computer occupation at 28.5 percent, which shows how quickly the outlook has been revised.
| Measure | Value | Source |
|---|---|---|
| Information security analyst jobs, 2025 | 192,900 | BLS OOH |
| Projected jobs, 2035 | 233,400 | BLS OOH |
| Projected openings per year, on average | 14,100 | BLS OOH |
| Median annual wage (May 2025) | $129,180 | ConnectPrep, citing BLS OEWS |
Job-posting data points the same way. CyberSeek, a NIST-supported tool, reports that employers posted 514,359 listings over the prior 12 months, an increase of nearly 57,000 listings, or 12 percent, over the previous period. Posting counts are not the same as unfilled positions, and CyberSeek's 2024 release estimated that about 225,200 more workers were needed to close talent gaps at that time.
Where the squeeze is worst: smaller organizations and nonprofits
Expertise is unevenly distributed. In the World Economic Forum's 2026 outlook, as summarized by StingrAI, the share reporting a lack of cyber expertise is higher among public-sector and NGO respondents than among large organizations. Verify these values against the WEF report before quoting them.
Washington State research is more direct about nonprofits. A UC Berkeley CLTC study surveyed 100 nonprofits and found that the smallest ones had the largest staffing gaps and were least likely to buy managed security services. The same study concludes that nonprofits lack the capacity to invest in cybersecurity because of staffing and budget limits. Nonprofit IT guides say the same thing in general terms, noting that volunteers and part-time staff who need system access add onboarding and access-control work. Those are the same people your program screens.
What this means for your volunteer program
The data points to a clear conclusion: if a skills gap is the main constraint on security, then trust in access decisions matters more than headcount. A volunteer with a login to a donor database, a rostered van or a child-facing schedule is a real access decision. That is why screening should be treated as a security control, not just an admin step. VolunteerBadge runs FCRA-compliant background checks with identity verification and no monthly fees, so small teams can verify people before they receive access. Start with our identity verification feature, review the run checks guide, and compare plans on the pricing page. Program leaders who want a sector view can start at our nonprofits page. For leaders balancing digital risk with liability, our church liability statistics report and the cloud computing statistics report place these trends in context.
Operationally, a small team can do three things this quarter: write down which volunteers hold system access, verify identity before access is granted, and tie access reviews to the same schedule you use for screening renewals. Our import volunteers tool can help you build that roster, and our VolunteerBadge Academy has training for leaders. Churches and faith groups with similar volunteer patterns can also compare notes in our faith-based volunteer statistics report.
Ready to verify your volunteers before they get access?
Start with VolunteerBadge: FCRA-compliant screening, no monthly fees
Download the data
Every statistic in this report, with its source and link, is included in the spreadsheet below.
Frequently asked questions
Q: Does ISC2 still publish a global cybersecurity workforce gap number?
A: Not in its 2025 study. ISC2 chose to focus on skills needs, and its last published gap estimate, 4.8 million, comes from the 2024 edition.
Q: How fast is cybersecurity employment projected to grow in the US?
A: The BLS projects 21 percent growth for information security analysts from 2025 to 2035, versus 3 percent across all occupations.
Q: How many cybersecurity job listings does CyberSeek track?
A: CyberSeek reported 514,359 listings in its latest 12-month period, up about 12 percent from the prior period. These are postings, not confirmed vacancies.
Q: Why do nonprofits feel the staffing squeeze more?
A: Smaller
