The Skills Gap Isn't a Headcount Problem Anymore. It's a Proof Problem.
October 6, 2026
Jillian, CMO— AI-assisted and reviewed prior to publication.
Cybersecurity's talent shortage used to be counted in open seats. Now it's measured in unproven skills sitting inside filled ones. ISC2's newest workforce data shows organizations have stopped worrying primarily about headcount and started worrying about whether the people they already have can actually secure AI systems and cloud environments, which changes what you need to prove and how you prove it.
What does ISC2's 2025 data actually say about the skills gap?
ISC2 surveyed a record 16,029 cybersecurity professionals for its 2025 Cybersecurity Workforce Study and found that 95 percent reported at least one skills gap on their team, with critical shortages up sharply year over year. The finding significant enough that ISC2 dropped its usual workforce gap number from the report because respondents consistently emphasized specific skills needs over workforce size, according to the organization itself.
That's a real reversal. For years the industry's go-to statistic was a global shortage measured in millions of unfilled roles. This year ISC2 didn't publish that number at all, because the more urgent problem is that 59% of respondents described their skills gaps as critical or significant, up from 44% in 2024. Teams are staffed. They're not equipped.
AI sits at the center of this. Among the specific capabilities named, 41% of respondents cited AI as a critical skill for the second consecutive year, ahead of cloud security at 36%. The same study found that a majority expect AI to reshape the job itself: 73% believe AI will create more specialized cybersecurity skills, 72% say it demands more strategic thinking, and 66% expect it to require broader skillsets across the workforce. Nobody in this data thinks AI is shrinking the job. They think it's making the job harder to prove you're qualified for.
Why can't organizations just hire their way out of this?
Because the people they need don't exist in enough supply, and the people they have can't demonstrate the specific capability fast enough through a resume alone. Almost nine in ten professionals in the ISC2 study said their organization suffered a significant incident tied directly to a skills gap, often more than once. That's not an abstract talent shortage. It's an operational failure that keeps recurring because the gap is invisible until it's exploited.
This is also why vendors are moving faster than usual. CompTIA is launching SecAI+ in February 2026 as the first credential in what it calls its Expansion Series, explicitly designed to sit on top of existing certifications rather than replace them. The company frames the problem in blunt terms: the AI security skills gap is the mismatch between the AI-enabled threats and tools an organization faces and its workforce's ability to secure AI systems and use AI safely in defense. That's a company selling exam vouchers saying the quiet part out loud: general security knowledge is necessary but no longer sufficient.
How does a stacked credential actually change what you can prove?
It changes the unit of proof from "I have experience" to "I passed a specific, current test of this specific capability." SecAI+ is built to complement, not replace, credentials like Security+, CySA+, and PenTest+, and it builds on foundational CompTIA credentials rather than competing with them. You keep the base credential that got you in the door and add a second one that answers the exact question a hiring manager or CISO is now asking: can you secure a model, not just a network.
CompTIA's own guidance on stacking makes the mechanism explicit. Stackable certifications are designed to show that you've accumulated credentials that together demonstrate a deeper mastery than any single exam can, and CompTIA's Stackable Certifications framework was built around exactly this logic: a foundation credential plus a specialization signals more than either alone. That matters more now that the industry's own trade press is publishing how-to guides on presenting these combinations correctly on a resume, because automated applicant tracking systems and human reviewers both need to see the stack, not just the newest badge.
Here's roughly how the layering works for a security-focused professional today:
| Layer | What it proves | Example |
|---|---|---|
| Foundation | Core security competency | CompTIA Security+ |
| Specialization | Domain-specific depth | CompTIA CySA+ or PenTest+ |
| AI expansion | Ability to secure and govern AI systems | CompTIA SecAI+ |
The point isn't to collect certifications for their own sake. It's that a single generalist credential no longer answers the question employers are actually asking, which according to CompTIA's own FAQ is becoming a defining capability: the ability to secure AI systems, manage AI-related risk, and support responsible AI governance as AI expands into core business processes.
What this means for your next certification decision
If you're deciding what to study next, weigh it against the specific gap ISC2 documented rather than the gap you assume exists. AI and cloud security are the two capabilities named most often as critical shortages, and a credential that maps directly to one of them carries more weight in a screening conversation than a broader renewal of something you already hold. Forge University's CompTIA SecAI+ prep track is built around exactly this layering approach, treating the AI security domain as an addition to your existing security foundation rather than a separate track you start from zero.
If you're earlier in your career and still building that foundation, the order matters less than the discipline of stacking deliberately instead of collecting credentials at random. Forge's resources hub walks through how the major certification pathways fit together, which is useful if you're trying to sequence a foundation credential, a specialization, and an AI-adjacent add-on without wasting study time on overlap. And if you're ready to put a plan in place instead of guessing at what to prioritize next, you can start training with a structured path built around where the actual gaps sit.
None of this means the base credentials stopped mattering. It means they stopped being the whole story. The professionals ISC2 surveyed aren't worried about being replaced by AI. They're worried about being outcompeted by peers who can prove, specifically and currently, that they know how to secure it. That's a solvable problem, but only if you treat your next certification as a targeted answer to a named gap rather than another line on a resume.