The government’s new Digital and Technologies Jobs Plan picks out cyber security as the clearest case of a jammed front door into tech work. It points to Cyber Essentials Certification Bodies and a possible IASME apprenticeship as ways in, but most of what it offers depends on employers choosing to hire juniors.
What happened
On 21 October 2026 the Department for Digital, Culture, Media and Sport published the Digital and Technologies Jobs Plan. Downing Street announced it on the same day, alongside 10,000 work experience and placement opportunities in the tech sector. Prime Minister Andy Burnham and Lisa Nandy, the Secretary of State at DCMS, fronted the announcement. Microsoft, Cisco, IBM, Cognizant and Arm are among the TechFirst partners that have made commitments.
The plan sits under the Modern Industrial Strategy and estimates that around 800,000 digital and technology roles will need filling between 2025 and 2035. Its headline commitment is around 20,000 entry-level jobs a year, made with employers through a new Digital and Tech Skills Deal. TechMarketView pointed out that the government’s own papers call this figure an ambition, not a forecast.
Cyber security is the plan’s main example of a field where the route in has narrowed, and it gets its own section on workforce, skills gaps and priority roles.
The detail
The figures on entry-level hiring are poor. According to the plan, 25% of core cyber job adverts in 2022 were open to candidates with less than a year’s experience. By 2025 that had fallen to 16%, and 64% of adverts asked for two to six years. Unemployment among cyber security graduates stood at 11% for 2022/23, compared with 6% for graduates overall. At the same time the number of cyber graduates grew 14% to 7,950 in 2023/24. Universities are producing more qualified people just as employers have stopped hiring them.
The plan also gives figures on the sector itself. It puts the dedicated cyber sector at 69,600 FTE staff, a 3% annual rise, within a broader cyber workforce of about 145,900. Growth has slowed, and 53% of cyber firms expect to take on staff in 2026, down from 67%. Meanwhile 57% of UK businesses report a basic technical cyber skills gap, up from 49%. In job adverts, AI skills more than doubled from 4% to 9% across 2024 to 2025, while automation skills climbed from 11% to 15%.
It names four priority role families: security analysts and incident response, penetration and security testers, security architects, and governance, risk and compliance. Employers told the government that governance and risk roles are among the hardest to fill, followed by testing and secure architecture.
The new idea is a section headed “Cyber Essentials: a route into cyber security”. It describes the scheme’s network of Certification Bodies as a base of employers where new entrants could gain real experience. It also says IASME, which delivers Cyber Essentials, is looking at an apprenticeship that combines training, mentoring and paid work.
The plan also leans on public procurement. Social value guidance announced in August doubles the weighting for local community benefit from 10% to 20% on contracts worth £5 million or more. Departments will attach key performance indicators to major contracts. For suppliers bidding for government security work, apprenticeships and placements now count more in the scoring.
Why it matters for UK organisations
A pipeline that won’t take on juniors stores up trouble. The plan’s own figures show employers asking for experience while fewer and fewer organisations are willing to provide it. If that continues, today’s shortage of mid-level analysts and testers will become a shortage of senior people in five to ten years. Smaller firms will be priced out first.
The impact goes beyond specialist security companies. Small businesses with little in-house expertise get much of their protection from managed service providers and local IT firms. If those providers can’t recruit and train people, the quality of basic security falls across the economy. With 57% of businesses already reporting a basic technical skills gap, that problem is already here.
Anyone bidding for public sector contracts should see the social value change as a commercial issue, not a charitable one. A credible apprenticeship or placement scheme can now affect whether a bid wins, and departments are promising to track delivery against what bidders promise.
Expert view
In my experience the shortage of entry-level jobs in this industry is largely self-inflicted. We complain about a skills shortage and then publish “junior” adverts that ask for three years of experience and a handful of certifications. The plan’s numbers bear that out.
The Cyber Essentials idea is sensible because it is practical. Assessment work is structured, repeatable and close to the basic controls that stop most opportunistic attacks: firewalls, secure configuration, user access, malware protection and patching. It is a good place to learn how real networks are put together and where they usually fail.
I have two caveats. First, IASME is only “exploring” an apprenticeship. Until it has a funded standard and Certification Bodies willing to take people on, it is a proposal and not yet a pathway. Second, the plan mostly relies on employer pledges, a voluntary Skills Deal and procurement incentives. None of them requires anyone to hire. TechMarketView warned that training and work experience could grow without a matching increase in paid jobs, and I share that concern.
AI makes this harder. The plan says there is not enough evidence to blame AI for the fall in junior hiring, but the tasks that once trained junior staff, such as triaging alerts and writing first-draft reports, are the ones being automated. If organisations automate those jobs without redesigning junior roles, they will lose the way they used to build experienced people.
What to do now
- Audit your own adverts. If an entry-level security role asks for several years of experience, rewrite it around aptitude, curiosity and basic networking knowledge, then train for the rest.
- Use the role families in the plan. Map your vacancies to analyst, tester, architect and GRC tracks and to the UK Cyber Security Council’s specialisms, so juniors can see how they progress.
- Certification Bodies: look at the IASME proposal now. Assessing against the five Cyber Essentials controls is a structured way to train new staff under supervision.
- Bidders: plan for social value. On public contracts worth £5 million or more, set out measurable placement and apprenticeship commitments you can actually deliver and report on.
- Redesign junior work around AI, don’t cut it. Give new starters supervised time on validating alerts and reviewing tooling output, so they learn the judgement that automation can’t provide.
- Consider the Skills Deal. One proportionate commitment through TechFirst is low effort and gets your organisation recognised.
Bottom line
The government has correctly identified that cyber security takes on too few beginners and has put numbers on it. Using Cyber Essentials as an entry route is a good, practical idea. Whether it works depends on employers creating paid junior roles, and nothing in the plan requires that. The industry caused this problem, and it is up to the industry to fix it.
Sources
- GOV.UK: Digital and Technologies Jobs Plan
- GOV.UK: 10,000 young people to get foot in the door of Britain’s tech sector as work placements rolled out across the country
- Computer Weekly: Prime minister announces thousands of tech-based work experience places for UK’s youth
- TechMarketView: Government launches Digital and Technologies Jobs Plan to tackle entry-level skills challenge
