Loading story…
A significant global shortage in cybersecurity professionals is exposing organizations to increased risks, including higher rates of data breaches, elevated recovery costs, and prolonged operational disruptions. According to Fortinet's Global Cybersecurity Skills Gap Report, 86% of organizations experienced some form of breach in 2024, with over half incurring recovery costs exceeding $1 million. Nearly all surveyed organizations reported that remediation efforts typically take a month, underscoring the strain on understaffed security teams. The ISC2 workforce study estimates a shortfall of approximately 4.7 million cybersecurity professionals worldwide, highlighting the scale of the challenge.
Melonia da Gama, director of training and learning programs at the Fortinet Training Institute, emphasized the need for organizations to have the right talent in place to build resilience. She discussed the rapid adoption of artificial intelligence and its implications for the cyber skills gap, the importance of addressing risk from the boardroom down, and the critical role of cyber certifications in strengthening organizational defenses. The ongoing skills gap is forcing organizations to reconsider their talent strategies and invest in training to mitigate evolving cyberthreats.
See attribution, scope, and your downstream exposure.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The cybersecurity industry continues to grapple with a persistent talent gap, with organizations struggling to fill critical roles due to a combination of hiring practices and perceived skills shortages. Carol Lee Hobson, CISO at PayNearMe, highlights that the issue is not solely a lack of qualified candidates but also stems from misaligned compensation structures and limited entry-level opportunities. She emphasizes the importance of creating clear pathways for newcomers, including internships and junior roles, to help bridge the gap between education and employment. Retention is another significant challenge, with many professionals leaving due to inadequate professional development, inflexible work environments, and insufficient support from leadership. Hobson notes that fostering a culture of mentorship and continuous learning is essential for building a robust pipeline of future security leaders. Diversity in the cybersecurity workforce is gradually improving, and this trend is seen as a positive force for innovation and resilience within teams. In parallel, industry experts argue that the most effective entry into cybersecurity is not through specialized roles like red teaming but by developing a strong understanding of risk management and business fundamentals. Security Operations Center (SOC) roles and foundational security positions are often more accessible and provide a broader perspective on organizational security needs. The misconception that red teaming is the primary or most prestigious entry point can deter candidates from pursuing other valuable career paths. Understanding how businesses operate and what assets need protection is considered more critical than technical prowess in offensive security for those starting out. Podcasts and industry discussions reinforce the message that a well-rounded skill set, including communication and risk assessment, is highly sought after by employers. The evolving landscape of cyber threats requires professionals who can adapt and think strategically, not just technically. Organizations are encouraged to rethink their hiring criteria, focusing on potential and aptitude rather than rigid experience requirements. By aligning compensation, offering flexible work arrangements, and investing in employee growth, companies can better attract and retain top talent. The collective insights from industry leaders and practitioners underscore the need for a holistic approach to cybersecurity career development, balancing technical skills with business acumen and people-centric strategies. As the field matures, the emphasis is shifting toward building sustainable, diverse, and adaptable teams capable of meeting the complex challenges of modern cyber risk.
Jun 29, 2026
The cybersecurity industry is grappling with a persistent skills gap, prompting discussions about the need for more generalists, the value of diverse backgrounds such as military veterans, and the current landscape of job opportunities. Industry voices highlight concerns that over-specialization and a focus on tool management have led to inefficiencies, while advances in AI and better design could help refocus efforts on solving core security problems. At the same time, the sector is actively seeking talent for a wide range of roles, from threat intelligence analysts to CISOs and data protection engineers, reflecting the breadth of skills required to secure modern organizations. Military veterans are increasingly recognized as a vital talent pool for cybersecurity, with their discipline, leadership, and mission-critical mindset translating well to cyber defense roles. The field is open to veterans from all specialties, not just those with technical backgrounds, and organizations are leveraging their unique skills to strengthen security operations. The ongoing demand for cybersecurity professionals, combined with calls for broader skill sets and the integration of non-traditional candidates, underscores the industry's urgent need to address workforce challenges and adapt to evolving threats.
Jun 30, 2026
Geopolitical instability, rapid technological advancement, and persistent skills shortages are fundamentally reshaping the cybersecurity landscape for organizations worldwide. According to a PwC report, 60% of executives now rank cyber risk investment among their top three strategic priorities, driven by concerns over political instability, trade disputes, and shifting alliances. Despite this heightened awareness, only about half of surveyed organizations feel very capable of withstanding cyberattacks on common vulnerabilities, and a mere 6% report preparedness across all vulnerabilities, highlighting significant exposure through legacy systems and complex supply chains. The financial impact of breaches remains severe, with over a quarter of respondents experiencing incidents costing at least $1 million in the past three years, disproportionately affecting large enterprises and technology-driven sectors. Spending on cybersecurity is increasing, with 78% of organizations expecting budget growth, yet only 24% are channeling more resources into proactive measures such as monitoring, testing, and training, indicating a continued reactive posture. The ENISA Threat Landscape 2025 report underscores the professionalization of cybercrime, the convergence of criminal and state-aligned actors, and the rise of hacktivist groups leveraging ransomware for both ideological and financial gain. Ransomware remains the most disruptive threat across the EU, with groups adopting decentralized operations, double- and triple-extortion tactics, and exploiting regulatory compliance fears to pressure victims. The proliferation of Ransomware-as-a-Service (RaaS), public leaks of builder tools, and the emergence of access brokers have lowered barriers to entry, fueling a diverse and persistent threat ecosystem. Weak authentication practices persist in many organizations, with passwords and SMS codes still dominant despite their vulnerability to phishing and credential theft. A significant portion of employees have never received cybersecurity training, and outdated policies further exacerbate risk, as personal and professional security habits often overlap, creating additional attack vectors. The adoption of stronger authentication methods, such as device-bound passkeys, remains limited, and resistance to multi-factor authentication is common due to perceived complexity. The use of AI in both attack and defense is accelerating, with AI-generated phishing campaigns and adaptive malware becoming more prevalent, while defenders also leverage AI for predictive threat detection. The overall picture is one of rising threat sophistication, uneven organizational preparedness, and a pressing need for sustained investment in proactive security measures, workforce training, and the adoption of advanced technologies to build resilience against an increasingly complex cyber threat landscape.
Jun 29, 2026