UK cyber skills gap widens

Britain’s cyber security workforce continued to expand last year, but businesses reported a widening technical skills gap as artificial intelligence became more deeply embedded in day-to-day security work.

Government research estimates that approximately 145,900 people were working in cyber security roles across the UK at the end of 2025, an increase of 2% from the previous study. Growth has slowed from the 5% recorded between 2023 and 2024, while recruitment indicators point to a labour market that remains demanding for employers and entrants alike.

Core cyber job postings increased by 7% compared with 2024. The report estimates that around 8,600 people entered the workforce through formal education and training pathways during 2025, but approximately 5,800 could leave during 2026 through retirement or career changes. Combined with expected demand growth, researchers estimate a requirement for around 10,200 new entrants during the year.

The wider economy continues to report substantial capability shortages. Some 57% of businesses were assessed as having a basic technical cyber skills gap, meaning people responsible for security lacked at least some of the capabilities needed to perform fundamental tasks effectively.

Artificial intelligence is adding another layer to that requirement. Around 70% of cyber businesses reported staff using AI in their day-to-day work, compared with 53% in the previous study. Automated tools can accelerate analysis, coding, threat detection, and routine administration, but organisations still need people capable of testing outputs, identifying vulnerabilities, and recognising when human judgement is required.

The education pipeline has expanded in some areas. The number of cyber security graduates increased by 14% between the 2022/23 and 2023/24 academic years to 7,950. Cyber-specific apprenticeship enrolments, however, fell by 15% between 2023/24 and 2024/25, creating a more mixed picture across routes into the profession.

Demand remains geographically concentrated. Greater London, Manchester, Birmingham, and Bristol accounted for the four largest concentrations of cyber job postings in the research, while Edinburgh moved into fifth place. Established technology clusters therefore retain an advantage in attracting experienced specialists, while employers elsewhere may depend more heavily on remote recruitment, internal training, or specialist suppliers.

The workforce also remains less diverse than UK employment overall. Women accounted for 16% of the cyber security workforce compared with 48% across the broader labour market, while disabled people represented 9% against 18% nationally. The report also identified increasing neurodiversity within cyber businesses, with the share of staff reported as neurodivergent rising considerably over several years.

The findings sit alongside wider evidence that AI access is expanding faster than intensive workplace capability. Cyber security raises a particular operational risk because weak implementation can expose data, systems, customers, and supply chains rather than simply limiting a potential productivity gain.

Employers therefore face overlapping pressures. Specialist cyber businesses require enough experienced people to meet customer demand, while companies throughout the economy need sufficient internal capability to manage cloud services, suppliers, identity systems, AI applications, incident response, and increasingly interconnected operations.

Smaller businesses can face the greatest difficulty because specialist recruitment competes with other technology spending. Buying security software does not remove the need for knowledgeable employees or advisers who can configure systems, interpret alerts, maintain controls, and respond when an incident occurs.

The study principally reflects the 2025 calendar year rather than providing a real-time snapshot of September 2026. Its direction is nevertheless consistent across several measures: the workforce is still expanding, the graduate pipeline has increased, AI usage has accelerated, and employers continue to report material technical gaps even as overall workforce growth slows.