The United States had more than 500,000 unfilled cybersecurity jobs in 2024 while incident reporting continued to rise. Survey results show 76% of respondents have implemented security automation in at least one area. With 33% of cybersecurity professionals saying they would leave for better compensation, workforce gaps and retention pressures shape HR decisions across the sector.
Key Takeaways
- 41% of cybersecurity professionals have obtained at least one industry certification (ISC)² workforce study survey result)
- 2,600+ occupations mapped to the NICE Framework across cybersecurity work roles (NICE Framework scope count)
- 12,000+ U.S. federal cybersecurity professionals certified under DoD/USAF programs (DoD cyber workforce certification reporting; count in DoD cyber workforce statistics)
- 74% of organizations reported a shortage of skills for roles in security engineering and operations (ISC)² workforce insights referenced in employer survey reporting
- 81% of organizations plan to increase cybersecurity spending in 2024 (Gartner forecast figure reported across enterprise security planning)
- $208.0 billion worldwide information security spending in 2023 (Gartner forecast figure cited in the same Gartner spending outlook release)
- 28% year-over-year increase in the number of security incidents reported to the UK’s National Cyber Security Centre (NCSC) from 2022 to 2023 (UK NCSC annual report figure)
- 61% of cybersecurity professionals have upskilled in the past year (ISC)² workforce development survey reported in (ISC)² continuing education findings
- $120,000 median annual pay for information security analysts in the U.S. in 2022 (BLS OES prior year median)
- $172,400 median annual pay for computer and information research scientists in the U.S. in 2023 (BLS OES; relevant high-skill cyber R&D)
- $151,000 median annual pay for penetration testers and ethical hackers mapped to related BLS roles estimate in 2023 (PayScale cybersecurity salary benchmarking)
- More than 500,000 unfilled cybersecurity jobs in the United States in 2024 (U.S. workforce gap estimate).
- 76% of respondents said they have implemented security automation in at least one area (survey-reported automation adoption).
- 59% of organizations reported using zero trust initiatives across the enterprise (survey-reported zero trust adoption).
- In the 2024 DBIR, 55% of incidents were financially motivated (share of incidents).
Cybersecurity spending is rising, but talent gaps and skills shortages keep intensifying, driving automation and upskilling.
Related reading
01 · Category
Skills & Certifications5 stats
01
41% of cybersecurity professionals have obtained at least one industry certification (ISC)² workforce study survey result)https://www.isc2.org/Research/Workforce-Study
02
2,600+ occupations mapped to the NICE Framework across cybersecurity work roles (NICE Framework scope count)https://niccs.cisa.gov/workforce-development/nice-framework
03
12,000+ U.S. federal cybersecurity professionals certified under DoD/USAF programs (DoD cyber workforce certification reporting; count in DoD cyber workforce statistics)https://www.defense.gov/News/Releases/Release/Article/3405852/
04
1,900+ training seats delivered by federal cyber apprenticeship programs in 2023 (CISA/NICE workforce program metrics)https://www.cisa.gov/resources-tools/cybersecurity-workforce
05
40% of organizations cite talent shortages as the main constraint on their security operations center (SOC) effectiveness (industry SOC survey figure)https://www.gartner.com/en/newsroom/press-releases/2024-02-22-gartner-says-a-majority-of-security-operations-are-not-using-automation-at-scale
Interpretation
Skills & Certifications Interpretation
With 41% of cybersecurity professionals holding at least one industry certification and 40% of organizations still pointing to talent shortages as the biggest SOC bottleneck, the Skills and Certifications data suggest that scaling credential pathways and training seats is critical, especially since federal efforts alone delivered 1,900+ apprenticeship seats in 2023.
02 · Category
Industry Budgeting4 stats
01
74% of organizations reported a shortage of skills for roles in security engineering and operations (ISC)² workforce insights referenced in employer survey reportinghttps://www.isc2.org/Research/Employer-Survey
02
81% of organizations plan to increase cybersecurity spending in 2024 (Gartner forecast figure reported across enterprise security planning)https://www.gartner.com/en/newsroom/press-releases/2024-05-20-gartner-forecasts-worldwide-information-security-spending-to-reach-2020
03
$208.0 billion worldwide information security spending in 2023 (Gartner forecast figure cited in the same Gartner spending outlook release)https://www.gartner.com/en/newsroom/press-releases/2024-05-20-gartner-forecasts-worldwide-information-security-spending-to-reach-208
04
$7.3 billion global market size for cybersecurity professional services in 2024 forecast (MarketsandMarkets cybersecurity services market estimate)https://www.marketsandmarkets.com/Market-Reports/cybersecurity-professional-services-market-1344.html
Interpretation
Industry Budgeting Interpretation
As budgets move up with 81% of organizations planning to increase cybersecurity spending in 2024 and global information security spending reaching $208.0 billion in 2023, the HR reality is that 74% are already reporting skill shortages in security engineering and operations, making staffing and talent investment a critical part of industry budgeting.
03 · Category
Hiring & Mobility2 stats
01
28% year-over-year increase in the number of security incidents reported to the UK’s National Cyber Security Centre (NCSC) from 2022 to 2023 (UK NCSC annual report figure)https://www.ncsc.gov.uk/report
02
61% of cybersecurity professionals have upskilled in the past year (ISC)² workforce development survey reported in (ISC)² continuing education findingshttps://www.isc2.org/Research/Skills-Certification
Interpretation
Hiring & Mobility Interpretation
From a Hiring and Mobility perspective, cybersecurity organizations are operating in a rapidly intensifying environment, with the UK’s NCSC reporting a 28% year over year jump in security incidents from 2022 to 2023 while 61% of professionals upskilled in the past year, signaling that talent movement and learning are becoming essential to keep pace.
More related reading
04 · Category
Pay & Benefits5 stats
01
$120,000median annual pay for information security analysts in the U.S. in 2022 (BLS OES prior year median)https://www.bls.gov/oes/current/oes151251.htm
02
$172,400median annual pay for computer and information research scientists in the U.S. in 2023 (BLS OES; relevant high-skill cyber R&D)https://www.bls.gov/oes/current/oes192999.htm
03
$151,000median annual pay for penetration testers and ethical hackers mapped to related BLS roles estimate in 2023 (PayScale cybersecurity salary benchmarking)https://www.payscale.com/research/US/Job=Penetration_Tester/Salary
04
$140,000median annual pay for cybersecurity analysts in 2024 (Glassdoor salary benchmark for “Cyber Security Analyst”)https://www.glassdoor.com/Salaries/cyber-security-analyst-salary-SRCH_KO0,18.htm
05
33% of cybersecurity professionals report they would leave for a better compensation package (2024 survey finding reported in trade press)https://www.darkreading.com/partners/report/cybersecurity-workforce-trends-2024
Interpretation
Pay & Benefits Interpretation
Pay & Benefits is becoming a critical retention lever as compensation levels vary widely across cybersecurity roles, with median pay ranging from $120,000 for information security analysts to $172,400 for computer and information research scientists, and the risk is real since 33% of cybersecurity professionals say they would leave for a better compensation package.
05 · Category
Workforce Demand1 stats
01
More than 500,000 unfilled cybersecurity jobs in the United States in 2024 (U.S. workforce gap estimate).https://www.cyberseek.org/heatmap.html
Interpretation
Workforce Demand Interpretation
In the workforce demand category, the United States faced a gap of more than 500,000 unfilled cybersecurity jobs in 2024, underscoring how strongly demand is outpacing available talent.
06 · Category
Industry Trends4 stats
01
76% of respondents said they have implemented security automation in at least one area (survey-reported automation adoption).https://www.varonis.com/blog/security-automation-statistics
02
59% of organizations reported using zero trust initiatives across the enterprise (survey-reported zero trust adoption).https://www.cisa.gov/resources-tools/resources/zero-trust-maturity-model
03
In the 2024 DBIR, 55% of incidents were financially motivated (share of incidents).https://www.verizon.com/business/resources/reports/dbir/
04
The NIST National Vulnerability Database shows a documented 61.9% increase in CVE entries from 2021 to 2023 (growth in CVE volume over the period).https://nvd.nist.gov/vuln/search/statistics
Interpretation
Industry Trends Interpretation
Industry trends in cybersecurity HR are being shaped by rapid operational change, with 76% of respondents reporting security automation adoption and 59% using zero trust initiatives, while the scale of risk continues to rise as financially motivated incidents make up 55% and CVE entries grow by 61.9% from 2021 to 2023.
report visual · Key figures
Talent shortages and upskilling are driving HR urgency in cybersecurity
A large share of both professionals and employers report skill gaps—while a majority of professionals are upskilling and many organizations plan higher cyber budgets.
74%
74% of organizations reported a shortage of skills for roles in security engineering and operations (ISC)² workforce ins
61%
61% of cybersecurity professionals have upskilled in the past year (ISC)² workforce development survey reported in (ISC)
81%
81% of organizations plan to increase cybersecurity spending in 2024 (Gartner forecast figure reported across enterprise
500,000
More than 500,000 unfilled cybersecurity jobs in the United States in 2024 (U.S. workforce gap estimate).
40%
40% of organizations cite talent shortages as the main constraint on their security operations center (SOC) effectivenes
source-verifiedisc2.org · gartner.com · cyberseek.org2024
Reference
Cite This Report
This report is designed to be cited. We maintain stable URLs and versioned verification dates. Copy the format appropriate for your publication below.
APA
Min-ji Park. (2026, February 13). HR In The Cybersecurity Industry Statistics. Gitnux. https://gitnux.org/hr-in-the-cybersecurity-industry-statistics
MLA
Min-ji Park. "HR In The Cybersecurity Industry Statistics." Gitnux, 13 Feb 2026, https://gitnux.org/hr-in-the-cybersecurity-industry-statistics.
Chicago
Min-ji Park. 2026. "HR In The Cybersecurity Industry Statistics." Gitnux. https://gitnux.org/hr-in-the-cybersecurity-industry-statistics.
Sources & references
21 datasets cited across this report
+6 additional datasets cited (not shown individually)