SOC Personnel & Workforce: Talent Shortage vs. Skills Gap, and the Number the Industry Stopped Publishing

What happened to the 4.8 million

You have seen the slide. Millions of unfilled cybersecurity jobs, a talent crisis with no end in sight, and an argument for buying something. The number came from the ISC2 Cybersecurity Workforce Study, which put the global gap at 4,763,963 people in 2024. A year later, the study came out with no gap figure at all.

The big picture: The cybersecurity skills gap has replaced the talent shortage as the industry's main workforce story. ISC2 now says the need for critical skills outweighs the need for more headcount. SANS reached the same conclusion in its 2026 workforce research. That correction is overdue, and it is also incomplete. Teams still report being understaffed, US job postings fell through 2026, and new analysts are struggling to find a first job. All of that can be true at once because "shortage" was covering several different problems.

Why it matters: A SOC leader who treats every gap as a headcount problem writes a requisition. One who treats every gap as a skills problem buys training. Both moves can miss the cause if the real constraint is budget approval, a job description nobody can meet, or case knowledge that lives in one senior analyst's head. This post opens our SOC Personnel & Workforce series, and the rest of the series depends on getting that diagnosis right.

By the numbers:

• 4,763,963 was ISC2's last global workforce gap estimate, up 19.1% from 2023, against an estimated workforce of 5,468,173, per the 2024 study. The 2025 study did not publish a new one.
• 95% of respondents to the 2025 ISC2 study reported at least one skills need, and 59% called those needs critical or significant, up from 44% in 2024.
• 60% of organizations named skills gaps as a bigger problem than staffing shortages in the 2026 SANS | GIAC workforce research, a 20-point spread that was four points a year earlier.
• 58% of organizations still say their cybersecurity team is understaffed, up from 55% last year, according to ISACA's 2026 State of Cybersecurity survey.
• US cybersecurity job postings fell 26.4% to 235,786 from January through September 2026, the lowest total for that period in four years, by CyberSN's count.
• Lack of skilled staff is the top operational challenge in the 2026 SANS SOC Survey, cited by 14% of respondents. Only 32% of practitioners say management pays close attention to SOC hiring and retention, compared with 59% of cyber leaders.

What the workforce gap measured

The 4.8 million figure was never a count of open jobs. ISC2 said so in the study itself: "It is not an estimate of current job openings." The gap measured the distance between the staff organizations said they needed to secure themselves and the number of active professionals. ISC2's methodology notes that hiring freezes and layoffs do not change the figure, because the need stays the same whether or not an organization can pay for it.

That is a legitimate thing to measure. The trouble came when the number traveled. Vendors, training programs, and the press repeated it as millions of open seats. In late 2024, security veteran Ira Winkler publicly accused ISC2 of "pushing a false narrative of a plentiful job market" while laid-off practitioners spent months looking for work, Assured Intelligence reported. The same ISC2 data showed a quarter of organizations had laid off security staff that year.

Each workforce number answers a different question. Most arguments about the shortage come from using one number to answer another's question.

Read together, those rows stop contradicting each other. Organizations can want more security people, lack the money to hire them, post fewer jobs, and still struggle to fill the senior roles they do post. CyberSeek's figures and Lightcast's report measure different windows, but they point the same way: the market is tight in specific places.

"Shortage" was covering four problems

The skills gap framing fixes one error and risks creating another. ISC2's own data doesn't support the idea that headcount stopped mattering. Staffing improved only slightly in 2025, with 34% of respondents saying they had the right level of staff. A missing estimate is also a different thing from a gap of zero.

The useful move is to split the word "shortage" into its parts.

A funding shortage. In the 2025 ISC2 study, 33% said their organization lacks the budget to staff the team adequately, and 29% said they can't afford staff with the skills they need. Hiring freezes reached 39%. The 2026 SANS SOC Survey found that 75% of cyber leaders say management understands technology needs skilled people to run it, while those same leaders name human capital as their top funding constraint. So the need is understood, and the budget still goes elsewhere.

An experience shortage. Lightcast's 2024 analysis found a 10% worker surplus for jobs needing under two years of experience, while jobs needing two or more years had 76% of the supply employers wanted. SANS found the same shape in 2026: 27% of organizations called expert roles their hardest to fill, 4% said the same of entry-level roles, and 55% of senior hires took six months or longer. CyberSN reads only 9.5% of 2026 postings as entry level, and 7.3% in defensive roles. The market is short on people who have already done the work.

A capability shortage. This is the skills gap in the strict sense: the people are in the seats, and the team can't do something it now needs to do. AI (41%) and cloud security (36%) top ISC2's list. ISACA reports that soft skills are the most cited gap at 57%, led by critical thinking, and that 45% see a gap in LLM SecOps, up 21 points since 2024. SANS found that 60% of organizations name lack of time as the biggest barrier to training. Teams are too busy with the queue to learn what would shorten it.

A retention shortage. ISACA reports that 55% of organizations struggle to keep qualified people, and that stress and limited advancement are the top two reasons people leave. We will spend the next post in this series on burnout and attrition, so one note for now: a departure costs you a seat, the experience that came with it, and whatever that person knew about your environment.

These four problems have different owners. A CFO, a hiring manager, a training lead, and a SOC manager would each have to act on a different one, and calling all of it a shortage makes it hard to assign any of it.

What the skills gap looks like inside a SOC

General workforce surveys cover the whole profession, including GRC, cloud engineering, and application security. A SOC's skills gap has a more specific shape.

Some of it is tool skill. SIEM proficiency is the most requested technology skill in SOC hiring, according to SANS, with nearly double the demand of EDR. Those skills show up in a job posting and can be tested in an interview.

The harder gap never makes it into the posting. A senior analyst looks at a sign-in and knows this executive travels to Singapore every October, that this service account always touches that database, and that the alert firing at month-end is finance doing what finance does. Command Zero cofounder and CPO Alfred Huger describes this as the institutional knowledge that turns telemetry into investigation: who owns the asset, why it matters, and what normal looks like for a specific user. You can't hire that on day one. An experienced analyst from another company arrives without it, and an AI system has it only if somebody gives it that context.

That is why a SOC can be fully staffed and still have a skills problem. If your best investigations depend on which analyst picks up the case, you have a distribution problem, and adding a body to the rota won't fix it. We covered a related risk in When Outsourcing Becomes a Liability: when a provider runs your investigations, this is the knowledge that builds up on its side of the contract.

Eric Hulse, our VP of Engineering, ran into the same problem when he moved from Tier 3 operations into engineering. The new tooling took weeks to learn. The months went to turning judgment that lived in his head and across a dozen consoles into something the new job could use. His summary of how organizations plan for that move in The Middle of the Shift Map: "Nobody budgets for the ramp."

Which shortage do you have?

Before the next requisition or training budget, match the symptom to the constraint. This table is our own working framework, built from the data above.

The third row deserves a closer look. In ISC2's 2025 hiring research, 38% of hiring managers said they require the CISA for entry-level roles and 34% expect the CISSP. Meanwhile, 81% of those managers said an entry-level hire can be trained to work independently in under a year, and half of organizations offer no mentoring. A team can complain about a shortage and still be screening out the people who could fix it by next year.

Where AI helps, and where it adds pressure

AI is already a response to the skills gap. ISACA reports that 35% of teams are leaning more on AI or automation to cover technical skills gaps, a 12-point jump in a year. For repetitive first-pass work, that makes sense. We covered what happens to the queue in From Alert Queue to Outcome, and the case for investing recovered time back into hunting and detection work.

Two complications come with it. First, AI adds to the skills list. In the SANS SOC Survey, 79% of respondents use AI or ML tools and 36% have built them into a defined workflow. The report warns of "confident, well-formatted output that no one has the expertise to challenge." Checking an AI verdict takes the same judgment the verdict was supposed to reduce the need for. Our own CTO, Dean De Beer, wrote that an override rate of zero is a warning sign of rubber-stamp review, a point we applied to buying decisions in RFP Fatigue.

Second, the work AI absorbs first is the work that used to train people. Among organizations seeing role changes from AI, SANS found SOC and security analysts lead reductions at 32%, though only 16% of organizations report actual headcount cuts overall. Posting data is more mixed: CyberSN shows SOC Analyst postings down 5.1% in 2026, a much smaller drop than the 30.5% for the broader Security Analyst category. So the Tier 1 seat hasn't vanished. The concern is what happens to it over time. If you take away the routine cases, you also take away part of how a junior analyst becomes the mid-level hire everyone is struggling to find.

That connects the two ends of the market. Too many candidates at the bottom and too few in the middle is partly a training pipeline failure, and automating the bottom rung without a replacement makes it worse. We took up the structural version of this in Does the Tiered Model Survive AI?, and career pathing gets its own post later in this series.

What industry experts are saying

ISC2 Acting CEO and CFO Debra Taylor described the turn when the 2025 study came out: "the most pressing concern for cybersecurity teams isn't headcount but skills," she said, as reported by DIGIT.

Rob T. Lee, SANS chief AI officer and chief of research, was blunter. He said the industry should "stop counting open positions" and invest in the skills of people it already employs, in the SANS announcement. His reasoning matches the training data: the people are there, and they're too busy running operations to build new capabilities.

The view from the bottom of the market is harder to hear. Lisa Countryman-Quiroz, CEO of the Bay Area job training nonprofit JVS, told Marketplace that "the rug has been pulled out from under" a generation of people who trained for these jobs. Her organization moved into cybersecurity training after entry-level IT jobs dried up. She now says employers seem to be hiring for senior roles, and she's unsure the program will continue.

Command Zero CEO Dov Yoran has been asking what that means for the people doing the hiring. You will still need experienced Tier 2 and Tier 3 analysts, he told CRN, so where do they come from "if you all of a sudden kill your Tier 1 footprint?" His comment was cited by Insight Partners, a Command Zero investor.

Dean De Beer argues in The Recomposition of Security Work that the profession's core risk is "a formation problem that a technology transition is about to make permanent." Formation is his word for the slow process of building judgment through real cases, and the paper's point is that organizations are making decisions about it now, often without realizing it, in how they buy tools and set headcount.

The limits of the argument

Between the lines: Skills-over-headcount is easy to agree with and easy to misuse. A CFO can read it as permission to freeze hiring and buy a course. Nothing in the data supports that reading. Most organizations in ISACA's survey still call themselves understaffed, and that number went up this year.

The data has limits worth stating. Most of these figures are self-reported survey answers, and several come from organizations with something to sell: ISC2 and ISACA offer certifications, SANS sells training, and CyberSN is a recruiting firm. SANS asked respondents to choose between "not having the right staff" and "not enough staff," which forces a binary many teams would reject. ISC2's hiring research only surveyed managers who already have junior staff, so it likely flatters the picture for early-career hiring. Posting counts include unfunded and duplicate roles, and CyberSN's entry-level share relies on a label inferred from the listing. CyberSN's SOC Analyst series is a small title-based sample of 4,161 postings. CyberSeek's latest public figures end in April 2025, and Lightcast's experience split is from 2024, before most of the AI SOC adoption discussed here. No independent study we found has measured how many SOC analysts the market needs, so our four-part split is a way of organizing the evidence and should be read as our interpretation. ISC2 could also bring back a gap estimate in a future study.

Command Zero has a stake here too. We sell an AI SOC platform, and our approach involves encoding expert investigative methods so that teams can apply them consistently, which is the fix we would naturally favor for a capability gap. We've tried to show where that argument stops: a platform doesn't fund a requisition, repair a job description, or develop an analyst by itself. Test what we say against your own closed cases.

The bottom line: ISC2 stopped publishing the number, and the industry is better off for it. The cybersecurity skills gap is real, and so are unfunded headcount, a thin middle of the experience ladder, and analysts leaving under stress. Before your next budget request, write down which of those you're trying to fix and who owns it. Then look at your last 20 closed cases and ask how many would have gone differently with a different analyst. If the outcome depends on who picked up the case, you have found your first problem to fix.

Terms in this post

Terms defined in Command Zero's glossary are linked below. Terms without a glossary entry yet are defined here.

• SOC (Security Operations Center)
• AI SOC
• SIEM
• SOC Tier 2
• Alert triage

What is the difference between a talent shortage and a skills gap?

A talent shortage means there are too few qualified people available to fill the roles employers want to fill. A skills gap means a team lacks specific capabilities it needs, even if its seats are filled. An organization can have either one, both, or neither.

What is the cybersecurity workforce gap?

The cybersecurity workforce gap was an ISC2 estimate of the difference between the number of professionals organizations said they needed and the number actively working. Its final published figure was 4,763,963 for 2024. It was never a count of open jobs.

Why did ISC2 stop publishing the workforce gap?

ISC2 did not publish a global gap estimate in its 2025 study. Reporting on the study says respondents emphasized specific skills needs over workforce size, and ISC2 reported that critical skills needs now outweigh the need for more headcount.

Is there still a cybersecurity talent shortage in 2026?

For experienced practitioners, the evidence says yes. Most organizations in ISACA's 2026 survey call their teams understaffed, and senior roles take the longest to fill. Overall US job postings fell in 2026, and entry-level candidates face a crowded market, so the shortage is uneven.

Why is it hard to get an entry-level cybersecurity job if there is a shortage?

The shortage sits mostly with experienced roles. Employers post relatively few entry-level jobs, some ask for certifications that require five years of experience, and AI is absorbing some routine work that junior analysts used to learn on.

What is a supply-demand ratio in cybersecurity?

CyberSeek's supply-demand ratio compares available cybersecurity workers with employer demand. A ratio of 74% means roughly 74 available workers for every 100 needed by employers, based on its estimates.

What is institutional knowledge in a SOC?

Institutional knowledge is the accumulated understanding of an organization's systems, users, business processes, and past incidents that lets analysts tell normal activity from suspicious activity in that environment.

Can AI close the cybersecurity skills gap?

AI can take on repetitive first-pass work and extend the capacity of a team. It also creates new skills needs, including the ability to verify AI output, and it can remove routine work that once trained junior analysts. It changes the gap more than it closes it.