Cybersecurity can have a skills shortage and still be hard to get into. The industry needs capable people. That doesn't mean it needs unlimited beginners. The shortage isn't spread evenly across experience levels, and the latest UK government research makes that unusually clear.
The line you'll keep hearing
"There's a cyber skills shortage." You've heard it at careers fairs, in bootcamp adverts and in the opening slide of every conference talk. Then you apply for forty junior roles and hear nothing back. Both experiences are real. The report explains why.
What the numbers say
The UK cyber workforce is estimated at around 145,900 people, up 2% on the year before. That's roughly 2,900 extra people. Core cyber job postings rose 7% in 2025 compared with 2024, and postings across all cyber roles rose 10%.
Don't read that as the boom coming back. The report itself says this may be stabilisation rather than a return to the high-demand market of the early 2020s. I'd agree. Recovering and booming aren't the same thing.
Meanwhile, 53% of cyber firms that were recruiting said they had difficulty filling vacancies. Principal-level roles got noticeably harder to fill. Governance, risk and compliance, secure system architecture and design, and audit and assurance were among the areas most often reported as hard to fill.
And then the entry level
Here's the bit that matters if you're trying to get in. Employers and recruiters interviewed for the research described entry-level cyber as saturated. That's their word. Some said they were overwhelmed with junior applications that lacked the right skills. Some said entry-level cyber roles increasingly required previous IT experience, including helpdesk experience.
None of that surprised me. I started on a service desk. The people I've seen move into security fastest were rarely the ones with the most certs. They were the ones who'd already spent time on systems other people depended on.
Why these aren't contradictions
The shortage and the saturation are about different people. The gap sits at principal level and in specific disciplines like GRC and architecture. The queue sits at the front door. Adding more beginners doesn't fix a shortage of people with ten years of judgment. It just makes the queue longer.
There's a second gap too. 57% of businesses lacked confidence in at least one basic cyber security task, up from 49%. The report warns that some of that rise may come from greater awareness, so I wouldn't treat it as proof that capability got worse. What it does show is that plenty of organisations need help they aren't hiring juniors to provide. They outsource it, or they go without.
So four things are true at once. More people want cyber jobs. Businesses still lack basic cyber capability. Employers struggle to fill senior and specialist roles. Beginners struggle to find work. That's not a paradox. It's a market that's short of experience, not short of applicants.
The pipeline problem nobody's solved
Employers raised this themselves. If entry-level roles keep shrinking, the route to becoming an experienced professional narrows. One put the question directly: where do future senior people come from if the junior roles aren't there?
I made the same argument in the real bottleneck in cybersecurity careers. It's now in a government report. Cyber-specific apprenticeship enrolment also fell 15%, which is one of the more practical ways into operational time.
Two more things worth knowing
70% of cyber businesses said staff were using AI in day-to-day work, up from 53% in the previous report. And some employers said they were receiving AI-generated applications that overstated candidates' skills. Easier to apply. No easier to prove you can do the job.
Cyber graduates rose 14% to 7,950. More people are coming through education, into the same crowded entry point.
What to do with this
If you're outside the industry, stop aiming straight at "junior security analyst". Aim at the job that gets you operational time. Service desk, systems administration, networking, cloud support. Then move sideways into security from inside, where your experience counts.
If you're already in IT, you're closer than you think. The experience employers told researchers they want is the experience you're building now. Write it down as evidence, not just a job title.
If you're mid-career, look at where the report says roles are hard to fill. GRC, architecture and assurance aren't glamorous. They're where the gap is.
Getting in is hard. It isn't random.
Turn the work you can access into evidence
That experience barrier is also a practical problem: applicants need a way to show what they have actually done. A lab, a personal project or a supervised volunteering task can provide specific evidence of reasoning, checks and communication when its context and limits are clear. It does not become employment experience simply because it is in a portfolio.
In My Waymark, capture the problem, your contribution, the alternatives you considered and the observations that support the result. Keep permitted supporting extracts, explain what remains untested, then select relevant examples for an interview or conversation. Use the remaining gaps to agree your next supervised opportunity.
Explore a complete first-role evidence example, including the finished dossier, or build your own record in My Waymark. This makes your work easier to examine; it does not replace an employer’s experience requirements or guarantee a role.