Bridging the Skills Gap: Unveiling Cybersecurity’s True Workforce Challenge

Bridging the Skills Gap: Unveiling Cybersecurity’s True Workforce Challenge

Summary

• Cybersecurity Workforce Crisis: A new SANS and GIAC report says the cyber workforce problem is mainly about skills, not headcount.
• Key Findings: More organizations worry about not having the right people than about not having enough people.
• Industry Response: The report points to hands-on training. It also stresses developing people in-house.
• Emerging Solutions: Employers are urged to widen their hiring pool and invest in upskilling the staff they already have.

Reframing the Cybersecurity Workforce Dilemma

The usual story is that cybersecurity has a talent shortage. A 2025 workforce study from the SANS Institute and GIAC argues the bigger issue is a skills gap. That is a different problem, and it calls for a different fix.

The Misinterpretation of a Talent Shortage

In the report, 52% of organizations said not having staff with the right skills was a bigger problem than not having enough staff. Plenty of people want security jobs. Many have basic IT knowledge but lack the specialist skills employers need for complex attacks.

What the Report Found

The study suggests hiring problems are partly self-inflicted. Some employers post job requirements that don’t match the work, which shuts out candidates who could learn the role. Fixing the job post is cheap. Training takes longer. Both help.

Industry Leaders Charting the Way Forward

The report’s answer is to spend more on developing people and less on chasing unicorn hires. That means targeted training and certifications, plus internal programs that move IT staff into security roles. Teams that grow their own talent also tend to keep it longer.

Certification as a Gateway to Skills Development

Certifications matter here, especially ones that test hands-on skills rather than memorized facts. GIAC, which co-published the report, sells such certifications, so readers should weigh that interest. Still, practical skill validation is a sensible way to show a candidate can do the work.

Fostering a New Generation of Cyber Professionals

Closing the gap also means widening the pipeline. Career changers are potential hires. So are veterans. So are people from underrepresented communities. Many need only a clear path in and some training.

Encouraging Long-term Solutions

Schools and universities help by matching their courses to what employers actually need. Partnerships between companies and colleges can turn classroom learning into job-ready skills.

Rethinking the Problem

Treating the workforce crisis as a skills problem changes the to-do list. Employers can write realistic job posts. They can train the people they hire. Educators can teach what the field uses. None of that is new. The SANS data just makes the case harder to ignore.

Fred Templeton, CISA, CASP, SEC+

Fred Templeton is a practicing Information Systems Auditor in the Washington DC area. Fred works as a government contractor and uses his skills in cyber security to make our country's information systems safer from cyber threats. Fred holds a master's degree in cybersecurity and is currently working on his PHD in Information Systems.