How AI is reshaping cybersecurity skills

Security teams need skills in advanced threats, judgement, and stronger governance as AI transforms cybersecurity work

Key takeaways

• AI is turning the cybersecurity workforce challenge from a head-count gap into a skills gap.
• 94% report cybersecurity skills gaps, led by AI risks and advanced identity and phishing threats.
• Organizations need human judgement and advanced expertise alongside AI and automation.

For years, the defining cybersecurity workforce challenge was head count: the millions of additional professionals needed to keep people, systems, and data secure. AI’s impact on cyberthreats, cyber defenses, business operations, and everyday work has now shifted the conversation.

Today, while head count still matters, the bigger issue facing the global cybersecurity workforce is skills. AI is changing the cybersecurity landscape faster than many security teams can build the necessary expertise, visibility, and governance. What does this mean in practice for resource-constrained organizations?

Barracuda Research’s new Cybersecurity Skills Gap Report draws on our international survey of IT and security professionals in organizations with between 100 and 2,000 employees. The findings show where the skills and capability gaps are, why they matter, and how the cybersecurity profession needs to adapt in the age of AI.

Security teams worry about gaps in technical skills and their ability to counter rapidly evolving threats

Almost all respondents (94%) report cybersecurity skills gaps, with the most common challenges linked to AI-related risks (68%) and advanced identity and phishing threats (67%), including business email compromise, OAuth abuse, and multifactor authentication bypass.

More than a third (35%) report a lack of expertise in incident-response speed and decision-making under pressure, while 32% find it difficult to translate technical risk into business impact.

Security teams struggle to keep pace with expanding business expectations

Security teams are being asked to protect a larger, more complex, and increasingly AI-enabled environment without a corresponding increase in people, skills, or technology.

Half say security professionals are expected to support growing digital operations without additional resources, while 40% say business expectations exceed their teams’ skills and tooling. Consequently, 67% say their teams are struggling to scale as business needs expand and evolve.

AI is transforming security teams

Most (79%) report that AI is already affecting security roles or head count. More than half (56%) have experienced professional workforce reductions linked to AI, divided evenly between entry-level and more senior positions.

The need to reshape cybersecurity careers

As organizations implement consolidated security tools and AI takes on more routine analysis and response activities, human roles are becoming more strategic — but many lack the required skills.

More than half of the organizations surveyed (56%) say they need additional expertise in incident response, decision-making under pressure, and risk management. These shortages could deepen if organizations automate entry-level work without creating clear development pathways for new cybersecurity professionals.

The definition of a senior security professional is also broadening. Technical expertise remains essential, but it increasingly needs to be combined with AI literacy, identity security knowledge, governance awareness, and strong communication skills as cybersecurity becomes a board-level business issue. Accordingly, 61% report a need for strategic security leadership skills, including AI governance and the ability to translate technical risk into business impact.

What this means for organizations and security leaders

Organizations need to reshape their security teams by combining AI and automation with human expertise, judgement, and oversight. They must also nurture these capabilities in the next generation of cybersecurity professionals by creating development pathways and opportunities for hands-on experience.

In an AI-powered world, the most valuable security teams will not simply be those that can operate more tools or process more alerts. They will be those that can understand complex threats, challenge automated conclusions, make confident decisions under pressure, and keep the business operating when disruption occurs.

Cybersecurity skills and capability gaps are a global, industry-wide challenge. Addressing them will require sustained collaboration between business leaders, security teams, educators, and the wider cybersecurity community. This conversation is only beginning, and it must lead to action.

For further findings and insight, see the report.