For years, the cybersecurity industry has warned of a massive talent shortage. Not enough qualified professionals. Too many unfilled positions. Security teams stretched beyond their limits, struggling to defend increasingly complicated environments.
Now comes a contradiction: Employers are advertising dramatically fewer cybersecurity jobs, even as the threats confronting their security teams grow more sophisticated.
A new CyberSN report examining U.S. cybersecurity job postings from January 2023 through September 2026 found that hiring advertisements fell 26.4% during the first nine months of 2026 compared with the same period last year. The decline extends across nearly every cybersecurity function, from defensive operations and incident response to leadership and security awareness.
The findings raise an uncomfortable question for an industry that has spent years talking about its workforce shortage: If cybersecurity talent remains so desperately needed, why are employers pulling back on hiring?
The answer isn't as simple as AI replacing people or companies deciding they have enough security professionals. But the numbers suggest a cybersecurity employment market undergoing a significant recalibration, with consequences for experienced practitioners, newcomers and the organizations depending on them.
A cybersecurity hiring slump, not necessarily a collapse
CyberSN examined 41 cybersecurity roles across 10 functional categories using JobSpikr job-posting data.
Researchers identified 235,786 postings during the first nine months of 2026, compared with 320,210 during the corresponding period in 2025. That's a reduction of 84,424 role-query matches.
The decline is significant, but context matters: Compared with 2024, postings are down just 3.7%. Against 2023, they're down 13.8%. The unusually strong hiring environment of 2025 makes this year's contraction look particularly severe.
There's another important distinction: The market appears to have stabilized at a lower level rather than continuing to deteriorate. Quarterly postings have remained between 78,019 and 79,197 throughout 2026.
That suggests a lower hiring plateau, not an accelerating free fall.
Still, the weakness is widespread. Nine of the 10 cybersecurity functions recorded year-over-year declines, and 36 of the 41 individual roles experienced fewer postings. The median role suffered a 28.9% decline.
This isn't a handful of struggling specialties dragging down the averages. Employers across the cybersecurity profession are advertising fewer positions.
Security leadership and frontline defense take a hit
Some of the most concerning declines involve the people responsible for directing security programs and defending organizations against attacks.
Cybersecurity leadership postings fell sharply. CISO-related advertisements dropped 38.9%, cybersecurity director postings declined 32.5%, and cybersecurity lead positions fell 41%.
The defensive security function, which accounts for 41.5% of all postings, experienced a 29.8% decline. Offensive security fell 33.4%, incident response-related functions declined 29.8%, and cybersecurity education dropped 34.9%.
That last number deserves particular attention.
For years, the industry has argued that organizations need to invest more in developing talent, improving security awareness and creating pathways into the profession. Yet the category responsible for cybersecurity education experienced the steepest functional decline in the report.
It would be premature to conclude that companies are abandoning workforce development. Job advertisements alone cannot establish that. But the direction is hardly reassuring.
Security leaders already face growing pressure to do more with fewer resources. If organizations are reducing hiring while expecting existing teams to manage increasingly automated attacks, the consequences could extend well beyond employment statistics.
They could compound burnout, undermine institutional knowledge and leave security programs dangerously dependent on smaller groups of experienced professionals.
AI is changing the hiring conversation, but not necessarily eliminating jobs
Artificial intelligence is an obvious suspect whenever technology employment declines. Cybersecurity is no exception.
Yet CyberSN's findings don't support the simplistic narrative that AI is replacing cybersecurity workers.
Only 14.6% of postings during the first nine months of 2026 mentioned AI or machine learning, slightly below the 15.1% recorded during the corresponding period in 2025.
The picture changes when examining individual functions. AI-related language appeared in 32.7% of research postings and 23.3% of offensive security advertisements.
Meanwhile, Cyber Data Scientist postings increased 203.5%, climbing from 492 to 1,493. Cryptography and public key infrastructure positions also grew.
Research was the only functional category to post overall growth, increasing 26.1%, although much of that increase came from a September spike.
These findings suggest that employers may be redirecting some hiring toward specialized technical capabilities. They do not establish that AI is causing the broader decline.
The GRC growth story comes with a catch
Governance, risk and compliance appears to be gaining ground, increasing its share of cybersecurity postings from 9.4% in 2023 to 14.8% in 2026.
At first glance, that supports the argument that regulatory obligations, privacy concerns and AI governance are reshaping security hiring. But the underlying data complicates that interpretation.
Almost the entire increase comes from one category: cybersecurity and privacy attorneys. Their share of overall postings climbed from 4.1% to 10.3%, while the remainder of GRC actually lost ground.
The report cautions that broad legal job titles and changes in how employers describe privacy-related responsibilities could contribute to that increase.
In other words, GRC's growing share doesn't necessarily mean organizations are rushing to hire more traditional cybersecurity risk practitioners.
The entry-level problem remains unresolved
Perhaps the most frustrating finding concerns newcomers trying to establish cybersecurity careers. Only 9.5% of postings were classified as entry-level during the first nine months of 2026.
CyberSN identified a significant change in how its data provider classified seniority in June 2025, making meaningful year-over-year comparisons impossible. Nevertheless, the current figure underscores the importance of examining how employers develop their future workforce.
The industry cannot complain indefinitely about a shortage of experienced professionals while failing to create opportunities for people to acquire that experience.
The report also found that 9.2% of postings with a recognized employment type were contract positions, an increase of 1.4 percentage points from 2025. Nearly 23% of postings were flagged as remote, although another data-labeling change prevents a reliable historical comparison.
These numbers don't prove employers are replacing permanent staff with contractors or eliminating junior positions. They do, however, identify workforce questions that deserve closer scrutiny.
Related:
, and CYBR.SEC.Media
Bill Brenner
Bill Brenner
The talent gap needs a more honest conversation
CyberSN's research comes with important limitations. Job postings aren't the same as actual vacancies or hires. Some positions never appear publicly, and overlapping role searches can count the same advertisement more than once. Recent data may also be revised as additional postings are indexed.
The report doesn't establish why hiring has slowed, whether AI is responsible or how many cybersecurity professionals are unemployed. What it does establish is that the industry's advertised demand for cybersecurity talent has weakened considerably.
That should force a more productive discussion about the cybersecurity talent gap.
"We are now in the Task Economy and this data helps us understand which tasks are being automated first," said CyberSN CEO Deidre Diamond.
Organizations need to examine whether they're investing sufficiently in the people they already employ, creating credible pathways for newcomers and using AI to strengthen human capabilities rather than simply justify smaller teams.
Security professionals, meanwhile, face a market in which specialization, adaptability and demonstrable experience may become increasingly important.
The cybersecurity industry hasn't run out of threats. It hasn't run out of work that needs doing.
But if organizations continue demanding stronger defenses while advertising fewer opportunities to build the workforce responsible for delivering them, the talent shortage could become a problem the industry is actively making worse.
