Ransomware, AI and expanding attack surfaces are enabling cyber criminals to move faster, scale attacks and exploit vulnerabilities with greater precision at machine speed. Security teams are now operating in an environment where the window to detect and respond to incidents is shrinking, while the systems they need to protect are becoming more complex, writes Richard Woolfrey, pictured, Regional Director, UK and Ireland, at the cyber firm Fortinet.
Despite this, cybersecurity hiring is stalling and investment in workforce development is not keeping pace. This is creating a gap between the speed at which threats are advancing andorganisationsโ ability to build and retain the talent required to defend against it.ย So how can businesses close this gap and recruit, develop and retain the skills they need to protect themselves?
Attacks are becoming harder to contain
AI is giving threat actors new ways to generate malware, launch phishing campaigns and identify vulnerabilities at scale. According to our 2026 Global Cybersecurity Skills Gap Report, almost half of IT leaders now see defending against AI-enabled cyberattacks as a top concern, showing how quickly the technology has shifted from an emerging risk to an operational-wide threat.
Being targeted is a matter of when, not if. More than eight in ten organisations have reported one or more breaches in the past twelve months. These incidents are causing operational, reputational and financial damage, with more than half costing affected organisations over $1 million โ up from 38 per cent in 2021. At the same time, AI adoption, cloud migration and hybrid working are increasing the number of systems, identities and access points organisations need to manage. This widened attack surface makes it harder for security teams to maintain consistent visibility and control across the environments they oversee.
Talent pipelines are under pressure
While security demands are rising, many organisations are struggling to recruit the senior-level cybersecurity talent needed to manage complex environments and sophisticated threat actors. As a result, teams are being asked to do more without the depth of expertise required. IT leaders are also facing board pushback when seeking approval for additional cybersecurity headcount, even when cybersecurity is recognised as a business priority. This suggests that investment in people is still not matching the level of risk organisations face.
AI is adding another layer of pressure. As most organisations introduce AI into their cybersecurity strategies, they need professionals who understand how to deploy, manage and govern these tools effectively. Demand for those skills is growing faster than traditional recruitment cycles can support.
Addressing this challenge requires a more coordinated approach to people, processes and technology. First, organisations need to expand access to cybersecurity careers. Relying solely on traditional hiring routes is no longer sufficient in a market facing a shortage of experienced professionals. Apprenticeships, internships and industry partnerships can help create pathways into the sector and build a more diverse, adaptable workforce over time.
Second, businesses must invest in the people they already have. Certifications, structured training and continuous upskilling (of which many organisations are already doing) can help teams develop the expertise needed in areas such as AI governance, automation and security oversight. Finally, technology investment must be aligned with workforce capability. AI can strengthen detection and response, but it still depends on skilled professionals to operate it, interpret its outputs and make informed decisions. Technology alone cannot deliver resilience.
The threat landscape is changing quickly. To keep pace, organisations need to build cybersecurity teams that are not only larger, but better equipped. By developing existing talent, widening access to new skills and aligning technology with human expertise, businesses can close the skills gap and strengthen their ability to defend against future attacks.
