For years, the headline was a shortage of cybersecurity workers. The latest research shows the problem has become more specific.

What ISC2’s 2025 study found

The 2025 ISC2 Cybersecurity Workforce Study surveyed more than 16,000 security professionals worldwide.

– Skills shortages now outweigh headcount shortages. For the first time, ISC2 declined to publish a global workforce gap estimate, saying that skills gaps matter more than staffing numbers alone.

– 95% of respondents reported at least one skills gap, and only about 5% said they had none.

– 88% said their organizations had experienced at least one significant cybersecurity consequence linked to a skills shortage, and 69% reported more than one.

– AI and cloud security were the most-cited critical skills, at 41% and 36%.

– Many professionals see AI as a way to specialize and become more strategic, not as a threat to their jobs.

– Budget pressures remain a constraint, and many teams lack funds to hire people with the skills they need.

How leaders are responding

ISC2 reports that organizations are using three main approaches: training and development, investing in emerging technology to supplement staff, and outsourcing work.

Why outsourcing makes sense for smaller organizations

– 24/7 monitoring is nearly impossible with a small internal team

– Specialized skills (incident response, cloud security, compliance) are needed only occasionally

– Faster start: an experienced provider is available immediately

– Cost: shared services spread the expense of tools and analysts

– Insurance and customer requirements increasingly expect monitored security

What can be outsourced

– Managed detection and response (MDR)

– Vulnerability management and patching

– Security awareness training

– Compliance support and assessments

– Incident response retainers

– Virtual CISO guidance

What to keep in-house

Accountability. You still own risk decisions, business context, and relationships. A good provider supports your decisions, but doesn’t replace them.

Choosing a security partner

Ask about monitoring hours, response authority, reporting, how they secure their own environment, references, and exit terms.

Sources: ISC2 2025 Cybersecurity Workforce Study (published December 2025).

DBR Soft provides managed security services designed for small and mid-sized organizations. Contact us for more information.