Upskilling instead of hiring: how companies tackle the cybersecurity talent shortage

Upskilling instead of hiring is becoming the default response to the cybersecurity talent shortage in 2026 — not because external search is impossible, but because markets, budgets and technology pressure shift at once. ISC2 Security Training Trends 2026 shows heavy investment in internal development, with time and prioritisation still the hard constraints.

For staffing execution, see cybersecurity recruitment.
Market context: cybersecurity talent shortage explained. Sources:

• ISC2: Enterprise Training Trends (June 2026)
• ISC2 Cybersecurity Workforce Study 2025
• ISC2 Enterprise Training Trends Research Report 2026 (PDF)

The core point in one sentence

Nearly three quarters of enterprises are raising training budgets — but more than half still fail on time, not money. Employers that answer talent shortage with job posts alone miss the strongest lever many already control: role-based upskilling with clear prioritisation.

Why upskilling is now strategic

ISC2’s 2025 workforce study shows 59% reporting critical or significant skill gaps — up from 44% the prior year. 95% identify at least one gap. Many organisations also report budget limits on external hiring. The pattern is clear:

• External search remains necessary for rare specialist and incident-lead roles.
• Internal development closes broader gaps faster and cheaper — when structured.
• AI and cloud shift priorities faster than legacy certification tracks can follow.

Upskilling is therefore operational resilience, not an HR side project.

AI as the number-one training driver

47% of surveyed security leaders name artificial intelligence as their top training priority. 40% expect AI developments to create new training needs next year; 28% call out agentic AI explicitly. For employers that means:

• existing teams need AI literacy, not only a separate “AI security team”,
• governance, model risk and prompt/agent security belong in current role profiles,
• external-only hiring competes for a tiny segment while internal profiles can adapt.

Cloud security (44%), security analysis (44%) and risk assessment (40%) follow closely — signalling hybrid skill profiles, not isolated specialists.

Time is the real barrier — not budget

98% allow professional development during work hours. Yet 53% still cite time and scheduling as the top obstacle. Only 29% report insufficient budget. The practical lesson:

• training budget without protected learning time dissipates,
• managers must treat development as delivery work, not spare-time activity,
• quarterly micro-learning beats annual block workshops when operations never pause.

Role-based instead of one-size-fits-all

70% of organisations tailor training to role or function; only 3% run fully standardised programmes for everyone. That fits heterogeneous teams:

SOC and detection

• focus on alert triage, threat-hunting basics and communication under pressure,
• treat AI tools as assistance, not a substitute for judgment.

Engineering and cloud

• identity, segmentation, CSPM-adjacent controls,
• hands-on labs over slide-only sessions.

GRC and evidence

• translate regulatory language into technical measures,
• train documentation and audit routines.

OT-adjacent roles

• OT security (32% training priority in ISC2 data) for interface profiles,
• shadowing in operational environments with clear safety rules.

In-house, third party — or both?

77% use a blend of internal and external providers, leaning in-house (63% exclusively or mostly internal). 27% split effort evenly. For employers:

• in-house secures context, architecture and internal policy fit,
• third party delivers specialisation depth, current threat intel and certification paths,
• hybrid formats (54%) suit distributed teams.

Common mistakes: buying external courses without internal application planning; or running internal sessions without external quality benchmarks.

When upskilling is enough — and when it is not

Situation	Upskilling often sufficient	External hire more likely
Cloud basics, IAM hardening	✓
AI literacy in existing team	✓
GRC documentation, audit prep	✓
Incident lead under time pressure		✓
Rare OT security specialists		✓
CISO succession with board mandate		✓

The table is a prioritisation aid, not dogma — useful when budget and time are constrained.

A 90-day upskilling plan

Days 1–30: make gaps visible

• name top-five skill gaps per function (AI, cloud, IR, OT),
• sharpen role profiles with 12-month must-have criteria,
• block learning time in calendars — not only budget lines.

Days 31–60: start delivery

• role-based curricula with internal mentors,
• external modules for special topics (AI security, cloud),
• monthly short reviews: what was applied in operations?

Days 61–90: measure impact

• track reduction in open skill tickets or audit findings,
• decide which gaps remain for external hiring,
• retention conversations: communicate visible development paths.

Measuring training impact — not only booking it

ISC2 shows 86% of security leaders consider programmes effective; 94% feel on track with new technologies. That optimism holds only when employers measure impact. Practical indicators:

• application rate: how often was learning applied in operations within 30 days?
• incident metrics: has mean time to triage or escalation improved?
• audit findings: do recurring evidence gaps fall after GRC training?
• certification follow-through: 50% measure effectiveness via certification rates — useful when tied to roles.

Without measurement, upskilling becomes a budget line without delivery leverage. CISOs should share at least two KPIs per quarter with L&D and HR — not as control, but as prioritisation aid.

Common implementation mistakes

1. training without mentoring: courses without internal sponsors dissipate.
2. generic content: standard workshops without role relevance.
3. no protected time: 98% allow development — 53% fail on scheduling.
4. no link to hiring: internal development and external search run separately instead of as one workforce plan.

Country-specific training priorities

ISC2 shows clear differences: in the UK and US, 54–55% name AI as top priority; in Germany AI sits at 43%, with cloud and security analysis at 39% each. Japan prioritises SecOps more strongly (39%). For international employers:

• global training catalogues rarely work without local adaptation,
• Germany often needs stronger OT and evidence focus,
• India and the US emphasise cloud scale more heavily.

HR and CISOs should not only approve global training budgets but prioritise regionally — otherwise the organisation trains skills that are not the biggest local risk lever.

Connection to the labour market

Upskilling does not replace recruiting — it relieves it. Teams that build AI and cloud capability internally search externally for true specialist gaps only. Market overview: cybersecurity job market 2026.

Conclusion

ISC2’s 2026 picture is clear: budgets rise, AI dominates training agendas, time remains the hard currency. Employers that address talent shortage with hiring alone lose speed. Those that combine role-based upskilling with targeted external search build more resilient teams — and reduce dependence on a market that does not grow faster than the threat landscape.