The security workforce in 2026: the shortage that was a budget

Why did the story change in a single year?

It probably did not. What changed is which explanation got recorded. For years the standard survey question invited respondents to explain a staffing shortfall, and the available answer that reflected well on everybody was that qualified people were scarce. It is a comfortable finding: nobody in the organisation is at fault, the remedy lies with universities and training providers, and the shortfall becomes a sector-wide condition rather than a local decision.

Budget as the leading cause is a less comfortable answer, because it names a choice made inside the building. It arrives alongside figures that make it hard to dispute: more than a third of organisations cutting security budgets, a similar share under hiring freezes, and a quarter reporting layoffs in the function. A team can hold vacancies and be forbidden to fill them at the same time, and from outside those two situations are indistinguishable.

The distinction has practical weight for anyone entering the field. Advice built on the shortage story — acquire the certification, the roles are waiting — describes a market where the constraint was supply. In a market where the constraint is funded demand, the same advice produces qualified people competing for a smaller number of posts, and the disappointment is read as a personal failure rather than as a misdescribed market.

One caution about all of these figures, including the ones on this page. They come from professionals answering questions about themselves, which is the only practical way to measure exhaustion and intent to leave, and it means the numbers describe what people report rather than what happens. Self-reporting has known directions of error: distress tends to be understated where an answer might be traced back, and intent to move is a poor predictor of moving. The findings are still the best available and they are worth reading as a description of how the work feels to the people doing it, which is a different claim from a measurement of the labour market.

Does outsourcing solve the capacity problem?

It is the structural answer most organisations reach for, and it moves a specific part of the load rather than the whole of it. A managed service takes over the activity with the worst hours and the highest volume — watching the queue overnight and at weekends — and does so with people who are awake anyway. That is a genuine transfer, and for a team of two or three it can be the difference between a sustainable job and an unsustainable one.

What does not transfer is the part that depends on knowing your organisation. Whether an administrator logging in from an unusual place at an unusual hour is an incident or a person on holiday fixing something is not a question about attack techniques; it is a question about your company, and the provider cannot answer it. So the alerts that survive triage come back, and they arrive with the context stripped out — which is why the volume reaching the internal team falls a great deal less than the volume leaving it.

The arrangement also creates work that did not exist before. Someone has to keep the provider supplied with the context that makes their judgements good, review what they closed, notice when their coverage of a new system quietly never got configured, and manage the relationship at renewal. That is not an argument against the model. It is the reason the internal team rarely shrinks by as much as the business case assumed, and why a service bought as a replacement for headcount tends to disappoint while the same service bought as relief for a specific duty tends to work.

The honest framing is that outsourcing changes which of the six activities the in-house team is short of, not whether it is short. Triage hours come back; the obligation to know your own estate does not go anywhere, and improvement work is still the residual it always was.

Two details decide whether it works in practice, and both are settled before signing rather than afterwards. The first is how an escalation reaches a human on your side at three in the morning, tested rather than described. The second is whether you receive the underlying data or only the provider's conclusions, because a team that cannot look at the original events is unable to investigate anything the service did not flag, and that limitation is discovered during the incident where it matters.

The shape of a career in this work

The shortfall leaders now describe is less about headcount than about particular expertise — securing machine learning systems, cloud identity, the plumbing between services — which changes what a career in the field looks like. For most of the period covered by this archive, the reliable path was breadth: know a bit of everything, because the job was to cover an estate alone. That path still exists at smaller organisations and it is where most people start.

Depth pays where the estate is big enough to need it, and the risk it carries is that the specialism can disappear underneath you. Practitioners who built a decade of expertise around a particular perimeter technology, or a particular platform, have watched the demand for it thin out in a handful of years. The people who handled that well were generally those whose depth sat in something durable — identity, cryptography, incident handling, the ability to reason about a system nobody documented — rather than in a product.

There is also a quieter fork between the technical track and the accountability track, and it is presented as a promotion when it is closer to a change of profession. The senior version of this job is largely persuasion, budgeting and writing, conducted with responsibility for outcomes that other people's spending decisions have already constrained. The burnout figures among CISOs are not surprising in that light, and anybody being offered the step is entitled to see it described accurately first.

For people entering now, the most useful correction to a decade of shortage coverage is this: the qualification gets you read, and what gets you hired is evidence that you have done something. A home lab, a documented investigation, a contribution to a tool — small, real, and yours — outperforms another certificate in a market where funded posts, rather than qualified applicants, are the scarce thing.

What actually helps?

Deciding explicitly what will not be done is the cheapest intervention available and the least often taken. Every overloaded function already drops work; the difference between a healthy one and an exhausted one is frequently whether the dropping was chosen and recorded, or happened by attrition at eleven at night. A written list of what the team is not covering this quarter converts a private failure into an organisational decision, and it is the only mechanism that reliably surfaces the funding question to the people who can answer it.

Protecting the two activities with no deadline comes next. Keeping current and making things better are the first casualties precisely because nothing breaks that week, and they are respectively the leading named source of exhaustion and the only category that shrinks the others. A standing allocation that is not raided for incidents — even a small one, even a single day a fortnight — is worth more than its size suggests, because it is the only part of the week that compounds.

Lastly, measuring the right shortfall. A team that reports vacancies is describing a symptom; a team that reports which duties fell below their minimum, and what followed, is describing the problem in terms a budget holder can act on. The first framing invites the answer that qualified people are scarce. The second does not allow it.

What a budget holder can act on is narrower than what a security team usually presents. Three lines cover most of it: the duties that fell below their minimum this quarter, the named consequence of each, and what it would cost to lift them. That is a proposal with a price on it rather than a complaint with a chart attached, and it converts the conversation from one about whether security matters — which nobody will say it does not, to no effect — into one about a specific sum against a specific exposure. It also has the useful property of being answerable with a no, which at least records that the decision was made deliberately and by whom.