The cybersecurity workforce problem is changing shape. SANS said Tuesday that skills gaps, not headcount shortages, have become the bigger issue for security teams, with 60% of organizations saying they lack the right capabilities to defend against current threats, compared with 40% that said they simply do not have enough staff. The figures come from the 2026 SANS GIAC Cybersecurity Workforce Research Report (registration gate), based on responses from 947 people across six regions.
“This is no longer a story about filling seats,” said Rob T. Lee, SANS chief AI officer & chief of research. “Organizations have people. But those people are overwhelmed, under-resourced, and unable to develop the capabilities they need because they’re too busy running today’s operations. The industry needs to stop counting open positions and start investing in the skills of the people it already has.”
The report argues that AI and regulation are reshaping the market at the same time. SANS said 74% of organizations reported that AI is already affecting cybersecurity team size and role structure, while only 21% said they have a comprehensive AI security framework in place. It also found that the share of organizations saying regulation is influencing hiring jumped to 95% in 2026 from 40% a year earlier. NIS2, CMMC, DORA, DoD 8140 and SEC rules were among the biggest drivers cited.
SANS said 27% of organizations reported breaches tied directly to workforce capability gaps, while 57% cited delayed projects and 47% pointed to slower incident response. The report shows AI is reducing manual analysis time and automating workflows more frequently than replacing jobs.
Photo by Christina @ wocintechchat.com M on Unsplash
