Certification Training Is the First Line CFOs Cut. The Breach Data Says That's Backwards.

October 8, 2026

Randy Hall, CEO— AI-assisted and reviewed prior to publication.

Certification funding is one of the easiest lines for finance to cut when budgets tighten, because it looks discretionary and its payoff is hard to put in a spreadsheet. The breach cost data says otherwise: organizations with a severe security skills shortage pay $5.22 million per breach on average, versus $3.65 million for those without one, a gap finance leaders can no longer treat as a rounding error.

That $1.57 million difference comes from IBM's 2025 Cost of a Data Breach Report, conducted independently by the Ponemon Institute across more than 600 breached organizations. It is not a one-year anomaly. The prior year's edition of the same report found that severe staffing shortages added a USD 1.76 million increase in average breach costs, and the 2022 report found a comparable gap years before AI entered the conversation. The skills shortage has been one of the most expensive line items in breach economics for most of a decade, and it is the one line item a training budget can directly move.

Why Are Certification Budgets Getting Cut While the Skills Gap Widens?

Because training is treated as a variable cost that competes with headcount and tooling, and it loses that competition more often now than it used to. Fortinet's 2025 Cybersecurity Skills Gap report found that only 73% of organizations would still pay for an employee to obtain a cybersecurity certification, down from 89% in 2023. That is a 16-point drop in two years, happening at the same time ISC2's 2025 workforce study found that 95% of respondents reported at least one skills gap on their team, up five points from 2024.

The reasoning behind the cut is not irrational on its face. A separate analysis of the same ISC2 data found that lack of budget has become the leading cited reason for both talent shortages, at 33%, and widening skills gaps, at 39%, overtaking "can't find qualified people" for the first time. When finance is already squeezed, a training line that does not show up as a hard asset or an incident avoided gets questioned before a renewal contract or a new hire does. The problem is that the breach cost data treats the skills gap as a cost driver with a dollar figure attached, whether or not the budget process does.

What Does a Skills Shortage Actually Cost Compared to Other Risk Factors?

It costs more than most of the controls competing for the same budget dollar. IBM's 2025 report lists the skills shortage alongside supply chain exposure, shadow AI use, and regulatory noncompliance as the factors that most reliably push breach costs higher, and quantifies each one individually.

Those first two rows are the average added cost per incident. The bottom row is the full gap between organizations with a high skills shortage and those with little or none, and it is the number that should anchor a budget conversation, because it is larger than most proposed security tooling purchases a mid-size company will see in a given year. A CFO comparing a $40,000 certification program against a $173,400 average cost increase per incident, on a risk that ISC2 says 88% of organizations experienced in the past year tied to a skills gap, is not comparing a discretionary cost against a hard asset. They are comparing two numbers on the same ledger.

How Should Leadership Decide Which Roles Get Funded First?

Start with the roles tied to the control gaps the breach data says are getting more expensive, not the roles that are easiest to backfill. ISACA's 2025 State of Cybersecurity survey of nearly 4,000 professionals found that AI is reshaping attack vectors, defense strategies, and policy development faster than most security teams can track informally, which is why ISACA built its Advanced in AI Security Management credential as an added layer on top of its management-track certifications rather than a standalone entry point. ISC2's own 2025 data backs the prioritization: AI was the single most pressing skill need, cited by 41% of respondents, ahead of cloud security and every other named category.

That has a direct implication for which certifications a budget should protect first when the whole line gets questioned:

• Management-track credentials like CISM give a team lead the governance and risk vocabulary that board and audit committee conversations now expect, and they are the prerequisite several newer AI-security credentials are built on top of.
• Technical and AI-adjacent credentials fill the specific gap ISC2 and ISACA both flag as the fastest-growing shortfall, rather than adding a generic resume line that does not map to a control the organization actually needs.

If you are building out a 2026 training plan rather than defending last year's, the CISM Certification Prep course is built around exactly this governance and AI-risk layer, since CISM is one of the two credentials ISACA requires before a security manager can sit for AAISM. Pairing a management credential with a plan for the AI-specific layer above it is a more defensible budget request than funding either in isolation, because it maps to a documented shortage rather than a generic upskilling goal.

Making the Case Without Overselling It

None of this means every certification pays for itself on a straight line, and a reviewer at the next budget meeting will ask that question directly. The honest answer is that the data supports funding roles and credentials tied to documented cost drivers, not funding certification spend as a blanket good. Fortinet's same report found that among organizations still unwilling to pay for certification, the top reasons were the risk of losing the employee after certifying them and straightforward budget constraints, both legitimate concerns a training plan needs to answer with retention terms or phased funding, not by ignoring them.

A useful way to frame the request is to tie it to a specific, named gap rather than a general one. ISACA's roundtable commentary on the 2025 survey results pointed to closing skills gaps through training, mentoring, and targeted hiring in areas such as AI security and incident response as the cornerstone strategy for teams stretched thin, which is a more fundable pitch than "more certifications" as a category. If your team needs a structured way to map current staff against those named gaps before the next budget cycle, the curriculum overview and FAQ on exam paths is a reasonable starting point for building that case internally.

The budget argument gets easier once it stops competing with tooling line by line and instead gets framed against the incident cost it offsets. A CFO who has already seen the Gartner projection that global information security spending will reach $213 billion in 2025 is not going to be persuaded that security spending in general is wasteful. The persuasion gap is narrower than it looks: it is about whether the training line specifically maps to a named, quantified risk, or whether it reads as a generic ask next to tools that come with a vendor invoice and a demo. If you want a study plan built around closing a specific, named gap rather than a general one, you can start training with a plan tied to the credential your risk profile actually needs.

The skills shortage is not a soft metric anymore. It has a dollar figure attached to it in the same report finance already uses to justify the rest of the security budget, and that figure has stayed in roughly the same range for three straight years. Treating the certification line as the easy cut ignores the one place in the budget where the cost of doing nothing is already measured.

Start training free at Forge University