AI adoption is accelerating across UK organisations, but the skills needed to implement, secure and work effectively with these systems are struggling to keep pace. Haris Pylarinos, Founder and CEO of Hack The Box, pictured, argues that as AI becomes embedded in security operations and wider business processes, workforce capability must become part of the conversation.
Organisations are under pressure to adopt AI, competitors are racing to demonstrate how they are using it and employees are working alongside AI-powered tools. Yet while investment in AI is accelerating, cybersecurity capability is struggling to keep pace.
This is not only an AI adoption issue. It is a cybersecurity workforce capability issue. Security teams need people who can implement AI securely, test it properly, challenge its outputs, understand its limitations and make sound decisions about where human oversight is required.
The UK already faces a significant cyber skills challenge. Now, UK Government research has found that 65 per cent of cyber businesses expected their need for AI skills to increase, while only 42pc had trained staff in AI concepts or algorithms (Department for Science, Innovation and Technology (DSIT), Cyber security skills in the UK labour market 2025). This demonstrates a gap between the pace of AI adoption and the ability of organisations to develop the skills needed to use it securely.
Skills gap as an AI capability problem
Security teams are being asked to protect traditional infrastructure, applications and data while also securing AI models, AI-enabled applications and increasingly autonomous systems. This introduces new attack surfaces and requires practitioners to combine established cybersecurity knowledge with an understanding of AI-specific threats. Prompt injection, data poisoning, model manipulation, model exploitation and attacks against AI agents all require security professionals to think differently about how systems can be compromised. Hack The Box’s Workforce Intelligence Report, based on more than 700,000 cybersecurity professionals worldwide, shows that AI security is moving up the training agenda. AI penetration testing is among the leading training priorities, alongside growing interest in areas including prompt injection, model exploitation and agentic AI security.
Not every security professional needs to become an AI engineer. But security teams collectively need the knowledge, practical skills and judgement to work effectively alongside AI, understanding both how AI changes the systems they defend and how it changes the way they perform their own role.
A penetration tester needs to understand how to assess AI-enabled applications and agents. A threat hunter needs to understand how AI changes attacker behaviour. A SOC
analyst needs to know when AI-generated analysis is useful and when it requires independent validation. Security architects need to understand how AI changes data flows, permissions and trust boundaries.
The depth of knowledge will vary by role, but the capability needs to extend across the security function. This is particularly important as organisations move from relatively simple AI applications towards systems that can access sensitive information, make decisions and take actions across multiple systems. Security teams need to understand the differences between these environments and determine what controls and human intervention are required.
Judgement is a critical security skill
There is a tendency to think AI literacy means knowing how to write an effective prompt or use a generative AI assistant. For security teams, those are only the starting point.
AI can accelerate analysis, threat investigation, code generation and security testing. But an AI-generated answer that appears convincing is not always accurate, complete or appropriate.
Security professionals need to know when to challenge AI, what evidence to look for, what assumptions it has made and what information it may have missed. They need to understand when an output can be accepted, when it requires independent verification and when a human decision-maker needs to intervene. This is increasingly what competence with AI looks like in cybersecurity. It is not just the ability to use the technology, it is the judgment to know when to rely on it and when not to.
As AI becomes more autonomous, this judgement becomes even more important. The greater the system’s ability to act without intervention, the greater the potential consequences when it gets something wrong.
Don’t automate away skills you will need tomorrow
There is another workforce issue that security leaders need to consider. AI is effective at accelerating routine and medium-complexity tasks. But these are also the tasks through which cybersecurity professionals develop experience and judgement. If AI takes over this work without a development strategy, organisations risk weakening their future talent pipeline. Junior professionals still need opportunities to investigate, make decisions, understand failure and build experience.
This does not mean resisting AI adoption. It means using AI to augment people while ensuring practitioners continue to understand the work they are performing and have opportunities to develop their capabilities. The objective should be an AI-augmented security workforce, rather than a workforce that becomes dependent on AI.
Practical skills need practical development
Building this capability needs more than theoretical knowledge. Security professionals need opportunities to practise against realistic scenarios. Understanding that prompt injection exists is very different from identifying a vulnerability in an AI-enabled application, understanding how it could be exploited and determining how it should be mitigated.
Cybersecurity professionals have traditionally developed practical skills through labs, simulations, capture-the-flag exercises and realistic attack scenarios. AI security needs the same approach. The aim is to give practitioners opportunities to experiment, make decisions, see where AI fails and develop the judgement to challenge its recommendations.
This is crucial as AI threats evolve. New models, attack techniques and agentic systems will continue to change the security landscape, meaning professional development must also evolve.
Workforce development is part of security strategy
For CISOs, AI capability must be an ongoing workforce development priority. In practice, this means understanding what teams can do today, identifying where capability gaps are emerging and providing relevant opportunities to close them. It also means measuring capability rather than assuming competence.
A strong approach is to build AI skills into existing cybersecurity roles rather than treating them as an entirely separate discipline. A penetration tester, SOC analyst or threat hunter still needs deep domain expertise. What changes is how that expertise is applied, directing, verifying and challenging AI as part of the job. AI competency can overlay existing offensive, defensive and security engineering capabilities, allowing teams to develop alongside the technology.
This can also help organisations address the wider cyber skills shortage. Instead of relying solely on recruiting scarce specialists, organisations can develop the people already within their security teams. AI adoption is often measured through investment, deployment and productivity gains. Cybersecurity leaders need to measure whether the people responsible for securing and using AI have the capability to do it effectively.
The UK wants to encourage AI innovation while strengthening cyber resilience. Achieving both needs investment in the people responsible for securing AI, not just the technology. As AI adoption accelerates, there will be increased demand for professionals who can secure AI, use AI effectively in security roles and exercise sound judgement over increasingly autonomous systems. AI is changing the technology landscape at extraordinary speed. We need cybersecurity capability to keep up.
About the author
Haris is the Founder and CEO of Hack The Box which has scaled to more than 300 employees and over four million platform members since its launch in 2017. Visit https://www.hackthebox.com/.
