UK Cyber Skills Gap: Building the Workforce Behind Cyber Resilience

The UK’s cyber skills shortage is becoming a wider workforce challenge, with organisations under pressure to find, develop and retain the capability they need to stay resilient.

That issue sits at the heart of The UK Cyber Skills Gap: Building Capability and Resilience, a new report from The CSBR, sponsored by RGH Global, a Resource Group Holdings Company.

The report looks at the people behind the UK’s cyber resilience: where skills are missing, why traditional routes into the profession are struggling to keep pace and how employers can make better use of talent already within their organisations.

It arrives at an important point for UK businesses. The Cyber Security and Resilience Bill has passed its second reading in the House of Lords, with committee stage due to begin in September. The legislation is intended to strengthen the resilience of essential services and the systems they depend upon, bringing greater expectations around cyber security, reporting and accountability.

Putting those requirements into practice will depend heavily on having the right people in place.

The skills gap reaches much further than the cyber team

One of the clearest findings in The CSBR report is the scale of the challenge across organisations.

The Cyber Security Breaches Survey 2025 found that 49% of businesses and 58% of government organisations had a basic cyber skills gap. Cyber knowledge is increasingly relevant across procurement, legal, finance, operations and leadership, alongside the specialist teams responsible for security itself.

For employers, that means looking at cyber skills as part of wider workforce planning.

A business can recruit an experienced cyber specialist into a key role, but resilience still depends on the knowledge and decisions of people throughout the organisation. It also means understanding where existing employees could develop into areas where skills are scarce.

That visibility becomes particularly important when the external market cannot provide all the talent employers need.

Employers are competing for the same experienced people

The report highlights a problem with the shape of the current cyber labour market.

Around 143,000 people work in the UK cyber workforce, yet employers continue to experience shortages in specific areas. In 2024, just 17% of core cyber job postings were aimed at entry-level candidates, while almost two-thirds were looking for people at mid-level.

It creates an obvious difficulty.

Businesses want people with experience, but the market needs employers willing to give people the opportunity to gain that experience in the first place.

Without stronger entry routes and progression opportunities, organisations end up competing for a relatively small pool of established professionals. Training alone will not fix that if people have nowhere to progress afterwards.

Retention matters too. The report points to skilled employees moving between organisations for better pay or greater career opportunities, meaning employers can invest in developing people without necessarily retaining that capability.

Career pathways therefore matter just as much as attracting people into cyber in the first place.

There may be more cyber potential in the workforce than we can currently see

A traditional recruitment process is heavily influenced by previous job titles, qualifications and experience. Those are useful measures, but they can make it difficult to spot people whose abilities could transfer into another area.

Someone may not have “cyber” written anywhere on their CV and still possess many of the skills or behaviours that could make them successful in the profession.

For organisations facing hard-to-fill roles, understanding that potential is becoming increasingly valuable.

It can mean looking at employees in adjacent disciplines, identifying people who could be retrained or redeployed, and giving existing teams clearer development routes into areas where demand is growing.

This is also why widening access to cyber careers matters. Creating practical routes for people moving from other industries, returning to work or changing careers gives employers a larger pool to work with and creates opportunities for people who may previously have been overlooked.

Better workforce data can change the decisions employers make

RGH Global supported The CSBR’s research because the issues raised in the report are already showing up in conversations with employers.

Organisations want to understand what skills they have, where their future gaps are likely to appear and whether they need to recruit externally or develop somebody already within the business.

That requires more information than a headcount or a list of job titles.

RGH combines recruitment expertise with workforce optimisation powered by Epitome, giving organisations greater visibility of skills, behaviours, potential and development needs across their workforce.

For an employer facing a shortage in a specialist area such as cyber, that can help answer some practical questions.

Who already has relevant transferable skills? Where could targeted development close a gap? Which employees have the potential to move into different roles? Where will external recruitment still be necessary?

Having that information allows businesses to plan rather than simply react when a vacancy becomes difficult to fill.

Building cyber capability for the long term

The CSBR report recognises that the UK already has a strong foundation, including initiatives such as CyberFirst, apprenticeships, professional standards and Cyber Essentials. Its recommendations focus on making those efforts more connected, improving routes into and through the profession, developing leadership capability and raising cyber skills across businesses and supply chains.

For employers, the message is practical.

Recruit experienced talent where it is needed, but invest in the people who can become that experienced talent in the future. Give employees clearer routes to progress. Understand which skills already exist across the organisation. And make workforce planning part of the conversation about cyber resilience.

The demand for cyber capability is unlikely to ease. As regulation develops and technology continues to change the risks facing organisations, knowing who you have, what they can do and where they could go next will become increasingly important.

The UK Cyber Skills Gap: Building Capability and Resilience report is available from The CSBR here.