SANS Report: The Real Cybersecurity Crisis Is a Skills Gap, Not a Talent Shortage — and AI Is Rewriting the Rules
Summary
The 2026 SANS | GIAC Cybersecurity Workforce Research Report, unveiled at RSAC 2026 on March 31, challenges the prevailing narrative around the cybersecurity talent shortage. Based on a survey of nearly 1,000 global respondents, the report found that 60% of organizations believe their teams lack the necessary skills to defend against current threats — making skills gaps, not headcount, the industry’s top workforce challenge for the first time.
AI is accelerating the shift. The report shows that AI is eliminating entry-level roles that historically served as training grounds: 32% of reductions hit security analyst positions, 26% threat intelligence analysts, and 22% incident responders. At the same time, 72% of organizations are creating new AI-related security roles — a net restructuring rather than simple job loss.
Perhaps most striking: regulatory directives now influence hiring at 95% of surveyed organizations, up from just 40% in 2025. And 27% of organizations reported breaches directly tied to capability gaps within their teams.
Source
Published by SANS Institute via GlobeNewsWire, with additional analysis from Industrial Cyber.
Commentary
This report finally names the real problem the industry has been dancing around. We don’t need more warm bodies in SOCs — we need people who can actually operate in an AI-augmented threat landscape. The “Junior Paradox” is particularly damning: 75% of junior roles require hands-on experience that juniors, by definition, don’t have. Meanwhile, AI is automating the exact entry-level tasks that used to provide that experience.
The regulatory surge from 40% to 95% in a single year is staggering and reflects the compliance tsunami rolling through the industry. Organizations are now hiring for compliance as much as capability, which creates its own distortions. The path forward requires intentional investment in skills development pipelines — not just posting “3-5 years experience required” on every junior role listing.
