Solving the cybersecurity skills gap: When hiring alone isn’t enough

Article

For years, closing the cybersecurity talent gap primarily meant one thing: Hire more people. That made sense when the work was relatively predictable.

Cybersecurity is harder to plan for now.

AI is changing how security teams work. Cloud environments are expanding the systems and identities organizations need to protect. Emerging technologies, such as agentic AI and quantum computing, are creating new security requirements before many organizations have the expertise to address them.

Organizations don't just need more cybersecurity professionals to manage these new workflows and challenges. They need access to the right capabilities as those needs change. In a SANS/GIAC Cybersecurity Workforce Report, 60% of organizations said skills gaps were a bigger workforce challenge than staffing shortages, at 40%.

That raises a harder question for security leaders: What capabilities does the organization need, and how can it access them as those needs change?

How to address the cybersecurity skills gap

The skills gap is a moving target
Start by distinguishing cybersecurity skills gaps from capacity problems
Hiring isn’t the only way to close the gap
Build, hire, borrow or automate
Reassess the mix as needs change
Build a security team that can adapt

The skills gap is a moving target

Cyber threats are becoming harder to predict and stop. AI gives attackers new ways to find and test weaknesses. Employees using third-party AI tools create new risks, while growing cloud and AI adoption significantly increases the systems, data and access points security teams must protect.

As AI, cloud, identity and access, data governance and other emerging technologies evolve, so do the capabilities security teams need to solve their challenges. According to research for Robert Half’s 2026 Tech Priorities and Opportunities report, tech leaders at small and midsize businesses (SMBs) face challenges securing cloud environments, infrastructure and emerging AI-related risks, often because of resource constraints. Those overseeing technology teams at large enterprises share concerns around cloud and infrastructure security, but many face the added challenge of defending increasingly complex IT ecosystems against sophisticated cyber threats.

But nearly half (47%) of all tech leaders surveyed have difficulty finding and developing specialized security talent.

“AI isn’t just expanding the places where attacks can happen; it’s also speeding up how quickly they can happen,” says Kim Bozzella, managing director and global leader of CIO and CISO C-suite solutions at Protiviti. “An exploitation that used to take days can happen in minutes. Think about how AI and advanced cyberattack technologies can find vulnerabilities and turn them into attacks at a speed that’s difficult for people to match.”

Those changes are reshaping what security teams need to know and do. Organizations need expertise across areas such as AI security, cloud security, identity and access controls, data and governance.

These evolving challenges and skills are reflected in Robert Half’s findings: security of IT systems and information remains technology leaders’ top priority for 2026, as it has since 2022. AI, data and governance priorities follow close behind.

Cybersecurity isn’t just an IT concern. It also ranks as both the top near-term risk and the top investment area for business leaders, according to Protiviti’s Executive Perspectives on Top Risks and Opportunities survey.

And a skills gap can lead to serious consequences. SANS research found that 27% of organizations have experienced security breaches directly tied to workforce capability gaps.

Closing the gap starts with understanding what kind of gap an organization actually has.

Start by distinguishing cybersecurity skills gaps from capacity problems

The first step is figuring out what kind of problem your team has.

A capacity problem means there is more work than the team can handle: too many tickets, an unsustainable on-call load or a growing backlog. The work is known, but there isn't enough time to get it done.

A capability problem, or skills gap, is different. The team lacks the expertise to do the work. Even with more time, it may not be able to securely deploy AI, hunt for AI-enabled attacks or translate technical risk into business decisions.

Clint Maples, senior vice president and CISO at Robert Half, draws a distinction between a capacity and capability problem this way:

“A capacity problem is ‘we cannot keep up.’ A skills gap is ‘we would not know what to do even if we had more time.’ In an AI-driven environment, most organizations have both—but treating a mismatch of skills as a shortage is how security teams stay busy and still get breached.”

That distinction changes the question simply from How many people do we need? to What capabilities are we missing—and how can we access them as needs change?

Hiring isn’t the only way to close the gap

Hiring could solve a capability problem if you find someone with the technical skills you need and the soft skills to work effectively with your existing team.

But cybersecurity skills are changing quickly, while the market for specialized talent remains competitive. Most (66%) tech leaders say hiring and retaining security and privacy talent is more challenging than it was a year ago.

Hiring may also come at a higher cost. The 2027 Salary Guide From Robert Half projects cybersecurity engineer salaries to grow 3.1%, compared with the 2.1% average increase for technology positions. Salaries can increase further depending on the skills and experience you need.

The answer, then, isn't to stop hiring. It's to stop treating hiring as the only lever.

A more flexible workforce model can give organizations access to specialized security skills when they need them. And make it easier to adjust as priorities change.

Build, hire, borrow or automate

Access the Guide

One way to create that flexibility is to match the workforce strategy to the capability gap.

The choice depends on the work. Tech leaders can apply this framework to help their security teams adapt as both skill and bandwidth needs change.

Build

Upskill existing employees when the capability is strategic and likely to remain important. For example, a security team might develop expertise in cloud security, AI security, identity or threat detection through hands-on training, rotations and relevant certifications. But don’t just help your employees add credentials; build capabilities the organization expects it’ll need over time.

Hire

Hire full-time professionals when specialized expertise must reside within the organization. This could mean bringing on professionals with expertise in areas such as cloud security architecture, AI governance, identity and access management, or SIEM and threat detection. For skills that are particularly scarce, be prepared to offer competitive, above-market compensation.

But technical expertise isn't the only consideration. Kathy Northamer, senior vice president, managed technology and digital solutions at Robert Half, notes, “Those very technical roles used to be ones where nobody knew what they did and they could largely work on their own. Now they can’t. So look for people who want to network, anticipate what’s next and keep learning.”

Visit the 2027 Salary Guide From Robert Half to find salary data for more than 70 tech positions.

Borrow

Bring in contract professionals and consultants when expertise is scarce and support is needed quickly or for a defined period. This can be useful for needs such as incident response, penetration testing, a cloud security initiative or other specialized work that may not justify adding full-time employees.

Automate

Use automation to extend the team's capabilities, particularly for repetitive work that can consume scarce security talent. Automation can help with tasks such as threat detection, vulnerability management and user access reviews, freeing people to focus on work that requires strategy and human judgment. Use automation as a multiplier, not a substitute.

To decide which option fits, leaders can ask:

Is this work core and recurring or episodic?

Do we already have adjacent talent we can upskill in 6–12 months?

How long would it take us to find the skilled professionals we need?

Can tools remove toil so existing people can absorb the new work?

Who remains accountable if the work fails—us, a vendor or a model?

Reassess the mix as needs change

The right workforce mix isn't a one-time staffing strategy. New AI products, cloud migrations, mergers and acquisitions, regulatory changes and customer commitments can all create new security requirements. Leaders must periodically reassess whether they have the right expertise, enough capacity and any emerging capability gaps as the business changes.

The reassessment should be part of business planning, not just workforce planning.

When security leaders are involved early in discussions about new technology and business initiatives, they can identify capability needs before they become urgent gaps.

They can also measure how quickly the team responds to change. Useful measures include:

How long does it take to stand up a new security control?

How quickly can the team build skills in a new area?

How long does it take to develop a useful detection for an emerging threat?

These measures shift the focus from whether the team has enough people to whether it can adapt when the business needs something new.

Build a security team that can adapt

The goal isn’t to build the biggest security team or predict exactly which skills will matter next. It’s to build a team that can adapt.

In addition to having the right workforce strategy, Maples believes an adaptive team is also a curious one. Curious security professionals are often so passionate about technology that they follow new developments, adopt new tools early and break things so they can figure out how to make them more secure.

Maples explains, “I do not need to predict the next skill. I need a team that can learn it faster than the threat or the business can outrun us. Building that kind of team requires durable fundamentals, AI literacy as a baseline, roles that can flex, automation that creates slack, and partners for the spikes. Prediction is fragile. Adaptability is the strategy.”

Discover more insights into technology skills gaps and workforce strategies.

Let us help you strengthen your team

While hiring alone isn't enough, we can help you find the right tech talent to join your team and fortify your cybersecurity function.

*Robert Half and Protiviti, a global consulting firm and Robert Half subsidiary, are members of the Microsoft AI Cloud Partner Program.

The tech and IT skills gap continues to evolve. Employers, what’s your action plan?

How to advance your digital transformation strategy with skilled talent

Technology modernization strategy: How to build the right team in 2026