94% Organisations Report Cybersecurity Skills Gaps: Barracuda Report

Nearly 94% of organisations report cybersecurity skills gaps, with AI-related risks and identity-based attacks emerging as major challenges, according to a new report by Barracuda Networks.

The Cybersecurity Skills Gap Report, based on an international survey of 2,000 IT and security decision-makers, found that 68% cited AI-related risks as a skills challenge. Another 67% pointed to advanced identity and phishing threats, including business email compromise, OAuth abuse and multifactor authentication bypass.

Security teams are also struggling to keep pace with growing business demands. Half of the respondents said security professionals were expected to support expanding digital operations without additional resources.

Meanwhile, 40% reported that business expectations exceeded their teams’ cybersecurity skills and tools. Another 35% said expectations exceeded their staffing capacity. As a result, 67% reported difficulties scaling security operations to meet changing business needs. Nearly 32% said they could protect their organisations only reactively rather than proactively.

“The findings show how the impact of AI is changing the cybersecurity landscape faster than many security teams can build the necessary skills, visibility, and governance,” said Siroui Mushegian, Senior Vice President and Chief Information Officer at Barracuda.

She further added that organisations needed to combine AI and automation with human expertise, judgement and visibility. She also highlighted the need to develop new training pathways and provide hands-on experience for the next generation of cybersecurity professionals.

AI is already affecting cybersecurity roles and headcount. The report found that 79% of organisations had seen AI affect security roles or staffing levels. More than half, or 56%, reported workforce reductions linked to AI. These reductions were split evenly between entry-level and more senior positions.

However, organisations continue to rely on human judgement for critical security decisions. Some 69% use a shared decision-making model for incident response. Under this approach, AI supports investigation and analysis, while people retain responsibility for context, judgement and final decisions.

The changing role of AI is also reshaping cybersecurity career requirements. As organisations consolidate security tools and automate routine analysis and response tasks, professionals are increasingly expected to handle threat investigations, lead incident responses, oversee automation and manage business risks.

56% of the surveyed organisations stated they needed additional skills in incident response, decision-making under pressure and risk management.

The report also found growing demand for strategic security leadership. Some 61% of respondents reported skills needs in areas such as AI governance and translating technical risks into business impact.

Technical expertise remains important, but security professionals are increasingly expected to understand AI, identity security and governance. Communication skills are also becoming more important as cybersecurity risks receive greater attention at the board level.