Cybersecurity Did Not Get Worse. It Got Crowded, Then It Got Closed.

I keep meeting young people who did exactly what they were told. Fifteen or twenty years ago the advice was sound. Get into cyber, the work is endless, the paycheck is guaranteed. 

Then the pipeline caught up. Degree completions are up about 35 percent over five years and graduates now outpace openings by roughly 15 percent a year. Since 2022 the share of postings open to candidates with under a year of experience fell from 25 percent to 17 percent, while 63 percent ask for two to six years. 

Applications per opening have doubled since 2022. The average posting draws around 250 applicants, entry level roles routinely pull 400 or more, and 75 percent of resumes are discarded before a human reads them. Only about half a percent of applicants are hired. We still advertise 514,000 unfilled US positions, which is true and misleading, because ISC2 now reports budget, not talent scarcity, as the top driver of understaffing, and Gartner expects generative AI to shrink entry level demand further by 2028. Crypto and AI, the two escape hatches, are just as crowded.

So we get a workforce that shows up for the check, and I do not blame one of them for that. I blame us. To reach the big shops you generally need someone to vouch for you, because referrals are about 7 percent of applications and 30 to 50 percent of hires. That is not meritocracy, that is inheritance with an ATS bolted on. And once inside, the work is sliced so thin that an analyst can sit in a queue for three years and never see how the business makes money, where the crown jewels sit, or why anyone would want them. Curiosity is not absent in these people. It is starved. You cannot ask why and how about a system you are never permitted to see whole.

Here is what should keep boards awake. The best are rarely the ones watching the crown jewels. They are consulting, building, or working the other side of the coin. The people holding the line are underpaid, overtooled, undertrained and structurally prevented from understanding what they defend. Ninety five percent of teams report at least one skills gap. We built that and called it efficiency.

If the person watching your most sensitive systems tonight cannot explain what your company would lose if they failed, is that a hiring problem or a design problem?

Reach out if you wish to discuss your Cyber departments staffing.