The bottleneck is skills, not headcount

ISC2’s 2025 workforce study surveyed 16,029 practitioners and decision-makers, and its most useful finding is a change of framing: the organisation stopped leading with a headcount gap because respondents no longer describe the problem that way. Instead, 95% reported at least one skill need, 59% cited critical or significant skills gaps, and 88% experienced at least one significant cybersecurity event in the past twelve months attributable to a skills shortage.

Why more hiring does not resolve it

A vacancy filled by someone without the specific capability the work requires produces a team that is larger and no more capable. That is the pattern behind the figures: the demand is for particular skills — AI was named as a top skill need by 41% of respondents and cloud security by 36% — and those are the hardest to buy in a market where every employer wants the same profile at the same time.

What tends to work when hiring is not the answer

• —Write down which capabilities the organisation must hold itself and which it can responsibly source from a partner — the second list is legitimate and shorter than people expect.
• —Grow specialists from operations staff who already understand the estate, rather than competing for scarce external hires.
• —Reduce the surface a small team has to cover: fewer platforms, fewer bespoke integrations, fewer exceptions.
• —Automate the repetitive controls so scarce judgement is spent on decisions rather than on collection.
• —Document runbooks so a capability survives one person taking leave, resigning, or being unavailable during an incident.

Retention is a capacity decision

In a market where the same skills are in demand everywhere, the practical constraint on a technology function is often how long it keeps the people it has trained. Time for deep work, a route to progress that does not require becoming a manager, and support for certification are cheaper than the recruitment cycle that follows their departure — and much cheaper than the outage handled by someone who joined last month.

A capacity plan that counts only people will keep producing the same surprise. The plan that helps names the capabilities, says where each will come from, and states what happens when the person holding one is unavailable.