New CyberSN figures show US employers advertised fewer cyber security jobs in the first nine months of 2026 than in any comparable period of the past four years, with penetration testing roles hit hardest. The UK picture from DSIT’s own labour market study is less dramatic but points the same way: slower growth, cautious hiring and a steady drift towards governance and risk.
What happened
On 16 October 2026 Help Net Security published an analysis by CyberSN, a US staffing and workforce intelligence firm, of cyber security job adverts collected through the job data provider JobSpikr. According to CyberSN, US employers posted 235,786 security roles between January and September 2026. That is the lowest January to September figure in the four years the firm has been tracking, and 26.4% below the 320,210 adverts in the same months of 2025.
CyberSN is careful to put that fall in context. 2025 was an unusually busy year, and against 2024 the decline is only about 4%. In effect, 2026 has erased last year’s gains and dipped slightly below 2024. Only September beat its 2025 equivalent, by under 400 postings. The data covers adverts rather than hires, and only the US.
The detail inside the total matters more than the headline number. As reported by Help Net Security, CyberSN found that:
- penetration tester adverts fell by nearly half compared with 2025;
- governance, risk and compliance (GRC) roles rose from 9.4% of postings in 2023 to 14.8% in 2026, while defensive engineering and analyst roles slipped from 47.1% to 41.5%;
- privacy and cyber security lawyers were alone among the biggest role groups in growing year on year;
- CISO adverts dropped 38.9% from the 2025 peak but climbed 19.5% between the second and third quarters;
- AI security engineer adverts more than tripled, although they still number only about 2,400.
CyberSN chief executive Deidre Diamond linked the swings in leadership hiring to churn in the wider C-suite and, asked about the GRC shift, told Help Net Security that “risk is the biggest conversation in the room right now”.
The detail
For UK readers the more useful benchmark is the Department for Science, Innovation and Technology’s Cyber security skills in the UK labour market 2026 report, published on 29 September and produced with Ipsos and Perspective Economics. It draws on Lightcast advert data for 2025 plus employer surveys, so it is not a like-for-like comparison with CyberSN, but the direction of travel is strikingly similar.
DSIT estimates the UK cyber security workforce at around 145,900 people as of December 2025, up just 2% on the previous year, compared with 5% growth between 2023 and 2024. Core cyber job adverts rose 7% in 2025 to 34,932, a modest recovery from the 2024 trough, but they remain 51% below 2022 levels. The report attributes most of that long-term fall to entry and early-career roles: adverts asking for under two years’ experience are down 53% since 2022, while those wanting more than ten years are down 30%.
Hiring intentions have cooled sharply. Only 53% of cyber firms expect to grow headcount, down from 67% a year earlier, and 46% expect no change. Turnover has edged up to 14% over 18 months. DSIT no longer publishes a headline skills gap figure, citing data limitations and weaker demand, and instead estimates the UK needs about 10,200 new entrants in 2026, mostly to replace people leaving.
On roles, the UK mirrors the US shift towards oversight. Security Manager titles rose from 22% to 27% of core adverts, governance and risk management is the most common specialism among cyber firms at 45%, and governance featured in around a fifth of postings. Penetration Tester accounted for just 2% of core job titles. AI skills were requested in 9% of adverts, up from 4%, and 70% of cyber firms say staff now use AI day to day.
Why it matters for UK organisations
There are three practical implications. First, the “skills shortage” narrative needs updating. The UK still has gaps, and DSIT reports that 57% of businesses have a basic technical skills gap, up from 49%. But the binding constraint for many employers is now budget and appetite to hire rather than a lack of applicants. That is a hard market for graduates and career changers, with cyber apprenticeship enrolments down 15%.
Second, the tilt towards GRC is being driven by regulation as much as fashion. The Cyber Security and Resilience Bill, DORA for financial services, NIS-style obligations on managed service providers and board-level accountability expectations all create demand for people who can evidence control, not just operate it. Organisations should expect competition, and higher salaries, for staff who combine technical credibility with audit and risk skills.
Third, falling demand for in-house penetration testers does not mean less testing is needed. Much of that work is moving to specialist consultancies, CHECK and CREST providers, and increasingly to continuous or AI-assisted testing services. Buyers need to make sure that shift does not quietly reduce assurance.
Expert view
In my experience, adverts are a lagging and noisy signal. A fall in pentest vacancies usually reflects how organisations buy the service, not whether they value it. Most UK firms have never employed a full-time tester; they commission work around releases, audits and contract requirements. What concerns me more is the collapse in junior roles. A profession that stops hiring at the bottom will pay for it in five years.
The GRC growth is healthy up to a point. Good governance turns technical findings into decisions and budget. The risk is a function that can describe controls in great detail but has nobody left who can verify they work. When we test organisations with mature paperwork and thin engineering, the gap between documented and actual control is often where the serious findings sit. AI tooling will absorb routine tasks, but someone still has to challenge its output and own the fix.
What to do now
- Protect the pipeline. Keep at least some entry-level or apprentice roles, and use DSIT’s finding that 65% of recruiting cyber firms already hire through non-degree routes as permission to widen criteria.
- Balance GRC with hands-on skills. Pair governance hires with engineers who can verify controls, particularly the Cyber Essentials basics: secure configuration, patch management, access control, malware protection and firewalls.
- Keep independent testing. If you are not hiring testers, budget for regular external tests from accredited providers and retest critical findings, rather than relying on scanner output alone.
- Cross-train for AI. With AI skills now requested in almost one in ten UK adverts, give existing staff structured training on securing and supervising AI tools rather than waiting to recruit specialists.
- Plan for retention. Rising turnover and redundancies mean knowledge walks out of the door. Document critical processes and review access promptly when people leave.
Bottom line
The CyberSN figures confirm what UK data has been hinting at since 2023: the cyber job market has cooled, and demand is moving from hands-on operational and offensive roles towards governance, risk and AI oversight. The organisations that come out ahead will keep doing both, and will make sure their growing compliance functions stay connected to people who can still test whether the controls actually work.
