The Cybersecurity Skills Gap

Overwhelmed cybersecurity executives hope AI can help them avoid missing signs of intrusions, even as they remain wary of the technology’s potential risks, the security firm Red Canary said in a report.

The report shows why so many security leaders are embracing AI: Three-quarters of them reported not having enough people skilled at intrusion detection, while 72% reported a skills shortage around incident response.

In addition, nearly three-quarters of security leaders said the amount of time it takes to resolve an intrusion has increased.

Red Canary’s report suggests that companies view AI as a partial solution to the significant burnout rates that threaten their defensive postures.

The report, based on a survey of 550 cybersecurity leaders from the U.S. and other Western countries, found that 85% of respondents worry about being overwhelmed by the volume of threats if they don’t use artificial intelligence to help spot intrusions.

“AI works best as a force multiplier, augmenting human judgment rather than replacing it,” Red Canary co-founder Brian Beyer said in a statement. “The organizations that lean into this shift now will not only ease the strain on security analysts, but put themselves in the best position to anticipate emerging threats and stay ahead of disruption in an increasingly unpredictable environment.”

But AI is also exacerbating security leaders’ worries even as it augments their capabilities. Three-quarters of respondents said they worried AI would reduce their problem-solving abilities, a major concern given the importance of human expertise in stopping increasingly creative attacks. Nearly half (43%) of respondents said their organization had already experienced a cyber incident related to their AI tools.

At the same time, executives think AI could help them spot increasingly sophisticated identity-based attacks. Nearly two-thirds of respondents are using AI for detection analytics, with another 59% using it for intrusion detection. Roughly 80% of security leaders reported experiencing intrusions in which attackers broke in with stolen credentials rather than malware.

The expanding range of devices that security teams have to protect has also made their jobs more difficult. Red Canary reported that the average organization’s attack surface has grown by 41% throughout 2025.

Survey respondents reported an average breach cost of $3.7 million, and nearly half of respondents said breaches had temporarily disrupted their services.

The AI era is transforming what CISOs do and how they do it, the enterprise software firm Splunk said in a report.

Nearly all CISOs have been assigned to manage their organizations’ AI governance responsibilities, the report found, a significant expansion of “their already overwhelming mandates.”

CISOs interviewed in the report expressed both an awareness that they needed to use AI and a range of concerns about its potential harms.

CISOs are feeling increasing pressure to integrate AI into their workflows, Splunk found, particularly as threat actors use the technology more often and in more potent ways.

“If your security function isn’t using AI, it’s like taking a knife to a gun fight,” Mike Salem, CISO of communications infrastructure operator IHS Towers, said in the report. “For CISOs, that can be a tough pill to swallow.”

Despite CISOs’ drive to adopt AI — more than two-thirds of them said investing in AI-driven cybersecurity capabilities was a very important or the most important priority — many of those who have already presided over significant AI deployments report only mixed results.

For example, just 39% of the CISOs who have partially or fully adopted agentic AI “strongly agree it has increased their team’s reporting speed,” Splunk said in its report. Nearly two-thirds of CISOs overall disagreed with the statement “agentic AI will replace some level 1 security team functions.”

Still, Splunk found that CISOs were bullish on agentic AI’s potential in several key areas of their portfolio, including speeding up data analysis (82% somewhat or strongly agreed that it would help in this area), mitigating workforce gaps (63%) and making human analysts more accurate (62%).

But agentic capabilities also introduce acute risks, and 83% of CISOs said they were most concerned about the impacts of AI model hallucinations. A lack of human oversight ranked second among their concerns, followed by potential legal liability associated with agents’ actions.

Splunk’s report is based on a survey of 650 CISOs taken in July and August 2025. Respondents represented nine industries, including manufacturing, telecommunications, energy and transportation, in nine countries, including the U.S., France, Germany and Singapore.

Beyond agentic AI specifically, data leaks and shadow AI represent major concerns for CISOs. More than three-quarters of CISOs said data leaks were their top concern. And CISOs already using generative AI were more worried about shadow AI (90% cited it as a top-three concern) than those who aren’t already using it (79%).

“Shadow AI presents a direct challenge to governance, control, and the integrity of security operations — in other words, everything the CISO strives to protect,” Splunk said in its report, adding, “CISOs who are further along in their generative AI journey are starting to notice some trade-offs.”

At a high level, CISOs are primarily concerned about threat actors’ increasing sophistication (95% identified this as a major challenge), the pace of technological evolution (89%), changes in the regulatory environment (76%), workforce shortages (47%) and budgets (42%), 

Few security executives believe that AI will solve their workforce problems. Only 1% of respondents said they considered new technology their best solution to skills gaps. Instead, CISOs are prioritizing upskilling and hiring. Many, however, are pessimistic about filling all of their open roles — only 16% said they expected to do so, while 79% expected many to remain vacant.

Splunk offered five recommendations for CISOs in the AI-infused era: prioritize translating their work into a language the rest of the business could understand; refocus on quality, not quantity, of work to address burnout; collaborate with other business leaders to “embed security into business strategy”; pair human intuition with machine automation; and emphasize clear AI governance to protect the technology they will inevitably have to adopt.

Sponsored content

By Immersive

In the executive suite, the conversation around AI has gone from theoretical potential to operational necessity. As we integrate AI agents and automated tools into the fabric of our organizations, a new leadership mandate has emerged. The challenge for today’s CISO and other business leaders is not merely managing a tech stack, but leading a hybrid workforce where human intuition and AI function together in a unified loop.

To navigate this transition securely and maintain a competitive speed to market, leaders must find a way to move past just thinking about the tools at their disposal. Success in this era belongs to those who position their teams as master orchestrators of a sophisticated, AI-augmented ecosystem.

From Discovery to Decision-Making

For decades, the value of technical teams—particularly in cybersecurity—was measured by their ability to "find." We rewarded the "finders": those who could sift through logs and identify vulnerabilities or anomalies.

AI has fundamentally changed this dynamic by making discovery essentially instantaneous. A security agent can surface thousands of high-severity exposures in seconds. However, this creates a critical bottleneck: judgment. When an automated tool identifies a dozen seemingly critical issues, the organization requires an expert who can determine which one actually poses an immediate and serious threat to the business.

We are entering the era of the "decider." These are the professionals who possess the foundational knowledge to interrogate AI output and use sound judgement to either validate or question it. They distinguish a hallucination from a hard truth and a fast fix from a fatal mistake. For an executive, the mandate is to pivot from hiring for discovery to upskilling for high-stakes decision-making.

Navigating the AI Tax through Internal Resilience

There is a persistent misconception that AI implementation is a straightforward cost-saving measure. In truth, early adoption often introduces an AI Tax, or the escalating costs of compute power, tokens, and the overreliance on premium external software.

The most resilient leaders avoid the trap of relying solely on external silver bullets. Instead, they build internal muscle memory. By arming early-career talent and senior analysts alike with the skills to use AI effectively, organizations can foster a culture of in-house innovation. It is far more efficient to take a professional who understands your specific business context and empower them with AI than to rely on generic tools that lack an understanding of your unique risk profile.

Leading the Agentic Workforce

As we move toward agentic AI, the question of accountability becomes paramount. We have reached a point where a cascading mistake is no longer a theoretical risk. An AI agent, in its rush to optimize, could inadvertently impact a production environment because it lacked the nuanced human-informed context of the system’s importance.

In this environment, you cannot blame the tool. Legally, operationally, and reputationally, accountability remains with the leadership. This is why keeping a human in the loop is a strategic imperative. Leaders must design a framework where humans provide the guardrails and the ethical compass for the agents they deploy.

The New Remit for the CISO

The role of the CISO is expanding from technical gatekeeper to the Head of Trust and Assurance. Leading a human-AI workforce requires a new kind of discipline, one that prioritizes verifiable resilience over blind automation.

To lead this new workforce effectively, executives should focus on three pillars:

1. Verification Over Reliance: Shift the team culture from trusting AI outputs to proactively verifying them through continuous, hands-on skill development.
2. Contextual Governance: Ensure that as AI agents are deployed, they are governed by humans who understand the business impact of every automated action.
3. Agile Upskilling: Treat the ability to interrogate AI as a core competency. As the tools evolve, the workforce’s ability to orchestrate them must evolve even faster.

The organizations that will dominate the market are not those with the most bots, but those whose leaders have successfully integrated AI into a human-led strategy. By focusing on the synergy between human judgment and machine efficiency, leaders can drive innovation without sacrificing security.

To get the full breakdown on how to move your team from "finding" to "deciding," watch the on-demand webinar: Resilience Starts Where Training Ends: Why Compliance Is Not the Same as Resilience.

One in four CISOs has experienced an AI-generated attack on their company’s network in 2025, and AI risks now top their priority lists, according to a report from the cybersecurity firm Team8.

The true number of companies targeted by AI-powered attacks “may be even higher,” Team8 said in its report, “as most AI-driven threats mimic human activity and are difficult to detect without advanced metrics like time to exploitation and velocity indicators.”

AI outranked vulnerability management, data loss prevention and third-party risk on CISOs’ priority lists, according to the report, which is based on interviews with more than 110 security leaders from major enterprises.

AI is creating a range of new cybersecurity challenges for CISOs, from newly effective attacks to newly vulnerable technology platforms.

The issues dominating CISOs’ minds are securing AI agents (which 37% of respondents mentioned) and ensuring that employees’ use of AI tools conforms to security and privacy policies (36%). Beyond AI-powered phishing and malware development, the report shows, executives are also worried about the unintended security consequences of their own companies’ use of AI.

“Boards are pushing aggressively for enterprise-wide [AI] adoption, and security leaders are expected to enable, not block, this transition,” Team8 said in its report. “That puts CISOs in the hot seat: charged with mitigating risk in a technology domain that’s still poorly understood, moving fast, and lacking mature controls.”

Almost half of companies still require employees to get permission to use particular AI tools, an allow-listing approach that Team8 said could cause friction with non-security executives eager to expand their firms’ AI use. “The demand for effective ‘allow-by-default’ controls is acute,” Team8 observed, “as security teams grapple with shadow AI usage and the absence of enterprise-grade governance frameworks.”

On the flip side, CISOs are also eager to incorporate AI into their own operations. Nearly eight in 10 CISOs told Team8 that they expect security operations center roles to be the first positions replaced by AI. Nearly half of those CISOs said that reducing their employee count was a major factor in their experimentation with AI-powered SOCs. Executives also expect AI to replace humans in the areas of penetration testing (which 27% of CISOs cited), third-party risk assessments (27%), reviews of user access requests (24%) and threat modeling (22%).

In the areas of penetration testing and threat modeling — where there is a major workforce shortage because of the required skills and knowledge — Team8 said that AI agents could “unlock expert-level capabilities across a broader surface area.”

Already, nearly seven in 10 companies are using AI agents and another 23% are planning to deploy them in 2026, according to Team8’s report. Interestingly, given the proliferation of agentic AI vendors, more than two-thirds of the companies using or testing AI agents said they were developing them in-house.

The Cybersecurity and Infrastructure Security Agency (CISA) is eliminating a program it used to retain uniquely valuable security professionals after an audit found that the agency had mismanaged the program.

In 2015, CISA’s predecessor inside the Department of Homeland Security created the Cybersecurity Retention Incentive (CRI) program to offer extra money to employees who were likely to leave the government for higher-paying private-sector jobs. CRI incentives were intended to apply only to a narrow subset of CISA employees with specialized cybersecurity skills. But, in September 2025, the DHS inspector general found that CISA was offering the incentives too broadly.

In a statement to Cybersecurity Dive, CISA said it would soon end the CRI program.

“The CRI program was never meant to be a permanent program, but was a temporary retention solution until the Cyber Talent Management System (CTMS) was operational,” said Marci McCarthy, CISA’s director of public affairs. “With that in mind, CISA intends to sunset the CRI program and fully utilize CTMS to recruit, hire, and retain its cyber workforce in the future.”

DHS launched CTMS during the Biden administration to create a faster hiring pathway for cyber staffers and offer those employees higher pay than they would normally qualify for as government workers.

The CRI program will end in two phases, according to a question-and-answer document for CISA employees seen by Cybersecurity Dive. “All non-cyber positions will be disenrolled from the CRI program on April 4, 2026,” the document said, “with the entire CRI program slotted to be sunset by September 30, 2026.”

Bloomberg first reported CISA’s decision to end the program.

Cybersecurity incentive program challenges

It remains unclear what will happen to employees receiving CRI payments, which often total tens of thousands of dollars per year. The incentives begin at 10% of an employee’s salary and top out at 25%.

In a recent staff memo announcing a hiring initiative, CISA’s acting director said that “existing employees retained under cyber retention incentives may … be transitioned to CTMS roles.” CISA leaders made similar comments during a Nov. 19, 2025, town-hall meeting, according to a person familiar with the matter.

Transitioning CRI recipients into CTMS would allow CISA to continue paying them effectively the same amount, but in the form of a salary above the standard government pay cap, rather than as supplements to the typical government salary.

It is unclear, however, how many employees will be transitioned. “Currently, you have to completely recompete for CTMS,” said a second person familiar with the matter. “They’ll have to significantly overhaul that system.” DHS, not CISA, runs CTMS, and while CISA could ask DHS to waive the recompete requirement, this person said they doubted DHS would be “willing to make those accommodations.”

The first person familiar with the matter agreed, noting that “presently there is no direct conversion path from a [standard federal] employee to a CTMS employee.”

There are also logistical challenges. More than 70% of employees in CISA’s Cybersecurity Division receive CRI payments, according to the second person familiar with the matter. “I have no faith they will be able to navigate the process to convert the entire workforce to a new program in less than a year.” CTMS is “a much better program,” this person said, and the change is “overall the right thing to do,” but, “I just have doubts it can be implemented in time.”

CISA did not address the recent IG report in its statement about ending CRI, but it indicated that concerns about wasted funds factored into the decision.

“As the nation’s cyber defense agency,” McCarthy said, “it’s critical that we hire and retain talented and driven experts to develop and deliver intelligence, services and support to critical infrastructure while ensuring good stewardship of taxpayer dollars.”

In the employee FAQ document, CISA promised to release an overview of its incentive policies by the end of March 2025. “Those programs will have a series of reviews and internal controls that will effectively meet audit compliance,” the document said.

Companies paid chief information security officers an average of almost 7% more in 2025 than they did in 2024, according to a recent report from IANS Research and Artico Search.

Meanwhile, companies spent only 4% more on security, according to the report.

The research, based on interviews conducted between April and October 2025 with more than 560 CISOs in the U.S. and Canada, suggests that executive compensation has weathered the economic headwinds that have otherwise constrained security budgets.

The IANS/Artico report provides a variety of data points that illustrate the market’s view of cybersecurity’s importance as a C-suite issue.

For one thing, equity-based pay grew faster than traditional salary pay, a fact that IANS described in a statement as a reflection of companies’ recognition of cybersecurity’s “long-term strategic value.”

“CISOs have firmly established themselves as business leaders, not just security operators,” Nick Kakolowski, IANS’s senior research director, said in a statement. “Their pay stability this year reinforces how indispensable cybersecurity leadership has become to enterprise risk oversight, even when many organizations are tightening budgets.”

In another sign that companies value cybersecurity executives highly, they are expanding the range of perks they offer to these employees. More than 70% of CISOs now receive executive perks, according to the IANS/Artico report, including directors and officers (D&O) insurance, which protects their personal assets from lawsuits targeting their professional decisions.

“The market for top security talent is still competitive, but motivations are shifting,” Steve Martano, a partner at Artico’s cybersecurity practice, said in a statement. “We’re seeing more CISOs prioritize influence, visibility and culture over pure compensation.”

While overall CISO pay increased modestly, there was a vast disparity between the highest-earning CISOs and the rest of the pack. The top 1% of CISOs by pay earn more than $3.2 million annually, a figure that is roughly 10 times the median CISO pay and 20 times the bottom 10% of CISOs’ earnings. “This variability reflects the impact of organization size, industry and experience,” IANS said, “with Fortune 100 CISOs often far exceeding reported averages.”

The report also documented a six-year high in the number of CISOs switching jobs, with 15% of CISOs saying they changed employers in 2025, up from 11% in 2024. Interestingly, only half of the CISOs who switched jobs received pay increases at their new companies. “Those who stayed and took on expanded responsibilities saw the largest compensation gains,” IANS said, “an average increase of 8.1% compared to 5% among job switchers.”

The Cybersecurity and Infrastructure Security Agency has canceled a major internship program for the 2026 summer season, dealing another blow to the government’s efforts to expand the cybersecurity workforce and attract talented professionals to federal service.

CISA said in December 2025 that it would offer paid summer internships through the government’s CyberCorps: Scholarship for Service (SFS) program to 100 undergraduate and graduate students. But over several days in mid-April, CISA officials have informed CyberCorps students that because the Department of the Homeland Security remains shut down, their internships were being canceled, according to media outlets.

“Due to the CISA/DHS current situation we will be sifting [sic] our focus away from the SFS summer internships,” a CISA official told CyberCorps participants, according to an email reported by Federal News Network. “As of right now there will be no SFS summer interns.”

In a statement, a CISA spokesperson said the shutdown prevented the agency from accepting CyberCorps interns this summer.

“We are unable to offer Scholarship for Service (SFS) summer internship opportunities as long as the Department is shut down,” the spokesperson said, because CISA is “restricted to performing only the most basic tasks — those essential for safeguarding lives, property, or national security.”

CyberCorps, managed by the National Science Foundation and the Office of Personnel Management, is one of the country’s most prestigious cyber workforce development programs. In exchange for federally funded tuition and stipends, participants intern for federal agencies and then work for them for the same amount of time as their scholarship. Government and industry leaders have hailed the program as a key tool for fostering young people’s interest in cybersecurity, filling critical vacancies at federal agencies and addressing a serious nationwide talent shortage.

The cancellation of summer CyberCorps placements marks the latest turmoil in a previously stable and thriving program. In 2025, Trump administration budget cuts prompted agencies to rescind CyberCorps offers, jeopardizing the scholarships of students who, through no fault of their own, suddenly couldn’t meet the terms of their agreements.

The resulting uncertainty demoralized many CyberCorps participants, and experts worry that it will discourage others from applying to the program in the future. A Reddit post about the chaos, which described the program as “a financial and professional trap,” attracted multiple comments from people who said they were CyberCorps graduates facing the same employment anxieties.

The Clinton White House created the CyberCorps program as part of a broader cybersecurity initiative in early 2000. The program awarded its first grants the following year, with the first group of nine participants graduating and joining the government in 2002.

In announcing the 100 internship slots in December 2025, CISA said they represented “a significant investment” in the agency’s “commitment to cybersecurity workforce development and national infrastructure resilience.” CISA’s acting director at the time, Madhu Gottumukkala, called CyberCorps “a cornerstone of our strategy to cultivate a robust pipeline of elite cybersecurity professionals who will protect the nation’s digital and physical frontiers.”

One recent email from CISA to CyberCorps participants, reported by Nextgov, acknowledged CISA’s recent unreliability in handling the scholarships.

“As of right now, there will be no SFS summer interns,” the email said. “I profusely apologize for the run-around this process has now given you two years in a row.”