Tara Wisniewski, ISC2 EVP of Global Advocacy and Strategic Engagement | Member Insight Blog | 16 April 2026

The UK cybersecurity workforce continues to navigate a range of disruptive challenges, including a skills shortage. Cyber skills development in the UK is essential for building long-term national resilience, including compliance with the UK Cyber Security Resilience (Network and Information Systems) Bill. As the world’s leading member association for cybersecurity professionals with more than 265,000 certified members, and associates, including more than 15,000 in the UK, ISC2 has been engaging with policymakers to address the UK’s cybersecurity skills shortage and share our perspectives on the Cyber Security and Resilience (CSR) Bill.

For example, during her testimony before Parliament on 3 February 2026, Dr. Sanjana Mehta, Senior Director, Advocacy, at ISC2, welcomed the introduction of the Bill as integral to improving the cyber resilience of UK organisations and sectors. The 2025 ISC2 Cybersecurity Workforce Study revealed that skills shortages are a key barrier for organisations to comply with regulations and legislation. Accordingly, Dr. Mehta’s testimony focused on the need to minimise unnecessary regulatory burdens to allow cybersecurity professionals to focus on responding to incidents and building cyber resilience. Dr. Mehta also called for more clarification throughout the Bill to allow professionals to adequately prepare for compliance.

In December 2025, ISC2 released its global 2025 ISC2 Cybersecurity Workforce Study, which included 954 survey respondents from the UK. The UK findings indicated that 58% of cybersecurity teams in the UK have critical or significant skills needs, up 11 percentage points from 2024.

Many organisations are concerned about the impact skills shortage will have on enabling them to comply with cybersecurity legislation and regulations. Skills shortages within organisations were identified as the biggest barrier to compliance along with lack of funding; more than half of respondents cited each issue as a barrier.

A Closer Look at the UK Cybersecurity Skills Shortage

The ability to operate an effective cybersecurity program is reliant on two primary assets: skills across cybersecurity teams and further access to qualified people. The most pressing skills needs among security teams in UK organisations reflects the changing nature of the UK digital economy and emerging technologies. Respondents were clear that AI was the highest skill need, as cited by 42% of respondents, followed by cloud security. Security engineering, application security and risk assessment, analysis and management round out the top five skills needs.

While the AI skills shortage is an issue for the cybersecurity workforce, cybersecurity teams that are actively using AI tools are positive about the current and future impact of the technology. Survey respondents indicated that they see opportunities for skills development, along with the creation of more and new jobs. Globally, 2025 Cybersecurity Workforce Study respondents see a symbiotic future where AI enhances the cybersecurity working experience rather than replacing skilled personnel.

At the time of the study, 17% of respondents stated that they were already using, testing or evaluating AI tools in their organisations, with 30% having already integrated AI tools. These findings represent a significant shift in how cybersecurity is practised in the UK, with implications for the skills organisations will need to develop. We already know that AI is being used in sophisticated cyber attacks. Here we see the other side of the coin: that AI tools also are being used to support cybersecurity operations in the UK. The report also found that the majority of cybersecurity teams in the UK that are currently working with AI security tools report positive experiences, with 70% stating they see a significant boost to their productivity after adopting AI security tools.

Causes and Consequences of Cybersecurity Skills Shortages

Budgetary constraints (cited by 28% of respondents) and not being able to hire people with the right skills were the top factors (25%), but struggling to retain people with in-demand skills and deploying new technology without the right skills to secure it also stood out as strong themes, perhaps unsurprising given the increasing use of AI discussed earlier.

These budget pressures have a direct impact on a cybersecurity team’s skills capability and readiness. With the introduction of the CSR Bill, many organisations will be subject to increasing regulatory burdens, further exacerbating budgetary pressures and skills needs. Our workforce study bears this out. Among survey respondents, 61% said their budgets would need to increase to comply with the new regulations, with about half saying budgets would need to rise by at least 10%.

Skills shortages have had a range of consequences for respondents and their organisations. A little more than a quarter (27%) of UK respondents have experienced oversights in cybersecurity processes and procedures at their organisation, while 27% reported that some areas go under-secured. A quarter cited their organisation’s inability to remain aware of all active threats against the network, as a consequence of the security team’s skills needs. Overall, 87% of respondents have experienced at least one significant cybersecurity consequence because of a skills deficiency within the team or wider organization, with 70% experiencing more than one.

A Shared Vision to Strengthen the UK’s Cyber Resilience

As the UK strives to strengthen the security and resilience of critical systems and organisations, addressing the cybersecurity skills shortage must remain at the centre of both policy and organisational strategy. Professionalisation, investment in the cybersecurity workforce and ongoing skills development are essential for meeting the expectations set out in evolving legislation. By working together to expand and sustain a competent, confident and well‑resourced cybersecurity workforce, the UK can move beyond today’s challenges and build a safer and more secure cyber world and digital future.

For more information about the global report, visit the 2025 ISC2 Cybersecurity Workforce Study.