Key findings
68%
of organizations report skills gaps related to AI risks.
67%
report skills gaps in advanced identity and phishing threats.
67%
say security teams are under pressure and struggling to scale.
32%
can secure the business only reactively rather than proactively.
69%
combine AI/automation and human expertise in incident response — people retain responsibility for context, judgement, and final decisions.
56%
reduced security workforce due to AI.
Executive summary
Cybersecurity teams are facing a growing capability challenge as AI, identity-based attacks, and expanding digital operations increase both the complexity and scale of cyber risk.
Barracuda Research’s international survey reveals that organizations are struggling to develop the skills, visibility, and governance needed to keep pace with this rapid change.
The findings suggest that the future of cybersecurity is not defined by head count alone. Organizations are prioritizing visibility, trusted AI, and operational resilience over additional staffing, signaling a shift toward a cybersecurity profession built on human expertise, business understanding, and accountable oversight of increasingly autonomous technologies.
Who this report is for
This report is written for security professionals and their employers, as well as managed service providers (MSPs) and others, to help them understand the skills and capability challenges facing security teams in the age of AI.
Methodology
Barracuda surveyed 2,000 mid- to senior-level IT and security decision-makers in organizations with between 100 and 2,000 employees from a broad range of industries in the U.S., UK, France, DACH (Germany, Austria, Switzerland), Benelux (Belgium, the Netherlands, Luxembourg), the Nordics (Denmark, Finland, Norway, Sweden), Australia, India, and Japan. The survey was undertaken for Barracuda by independent research agency, Arlington Research.
- The winds of change
- Skills gaps reflect the changing nature of attacks
- Security capability is not keeping pace with business demand
- Professional pressures affect the entire incident lifecycle
- Organizations want better operations and enhanced skills — not simply more people
- The emerging model for incident response is AI-supported and human-led
- AI is reshaping security roles and head count
The winds of change
The cybersecurity profession is heading for a perfect storm. Threats are becoming more targeted, identity-focused, and AI-enabled, while businesses are rapidly expanding their digital operations and adopting AI. The combined impact is changing the cybersecurity landscape faster than many security teams can build the necessary skills, visibility, and governance.
Barracuda surveyed IT and security leaders in several countries around the world on their skills and capability challenges over the last 12 months.
The findings suggest that the professional challenge facing organizations is not just about head count. Organizations of all sizes face a broader ‘capability’ challenge involving expertise, technology, the organizational approach to cybersecurity, leadership, and resilience. Organizations need teams that can understand new threats, make sound decisions during incidents, govern increasingly autonomous technology, and explain cyber risk in business terms — often while supporting more operations without receiving more resources.
Skills gaps reflect the changing nature of attacks
Almost all respondents (94%) report cybersecurity skills gaps, and most of these relate to the changing nature of attacks. For example, 68% report a skills gap related to AI risks, including capability to respond effectively to AI-generated and highly targeted phishing or social engineering.
At the same time, 67% report gaps associated with advanced identity and phishing threats, such as business email compromise, OAuth abuse, and multifactor authentication (MFA) bypass.
As AI tools become more widely used across business functions, they are creating new security and governance challenges.
38% overall say they lack the skills needed to secure and govern AI tools used by the business, but this rises to almost half of senior IT leaders. This suggests that many organizations are still developing the skills, visibility, governance, and policy controls needed to manage business AI usage effectively. As AI becomes embedded in everyday business workflows, understanding how AI systems access, process, and share organizational data is emerging as an important cybersecurity and governance challenge.
The findings also highlight skills gaps that extend beyond purely technical knowledge. More than a third (35%) report a lack of expertise in incident-response speed and decision-making under pressure, while 32% struggle to translate technical risk into business impact. This underscores that effective cybersecurity increasingly requires judgement, communication, and business understanding alongside technical expertise.
Security capability is not keeping pace with business demand
Skills gaps are being amplified by a mismatch between what organizations expect from security and the resources available to deliver it.
Half of respondents say security is expected to support new and expanding digital operations without additional resources. 40% say business expectations exceed their cybersecurity skills and tooling, while 35% say expectations exceed staffing capacity.
Security teams are being asked to protect a larger, more complex, and increasingly AI-enabled environment without a corresponding increase in people, skills, or technology. Overall, 60% report capability and resource gaps, and 67% say their security teams are under pressure and struggling to scale.
Almost a third (32%) say they can secure the business only reactively rather than proactively.
This suggests a damaging cycle: Expanding digital operations create more systems, identities, and activity to secure; limited visibility and fragmented tools make that work harder; overstretched teams focus on immediate incidents; and the time available for prevention, preparation, and skills development shrinks further.
Professional pressures affect the entire incident lifecycle
When organizations were asked to identify the activities that are most difficult to staff or support with the necessary expertise, the results are spread broadly across detection, response, continuity, recovery, and governance.
This shows that organizations need expertise and capacity across the complete incident lifecycle — before, during, and after an attack.
Organizations want better operations and enhanced skills — not simply more people
When asked what would help them manage cybersecurity more effectively, respondents place visibility and trustworthy AI ahead of additional head count.
The most frequently noted need is better visibility across identity, email, applications, networks, data, cloud services, and endpoints, cited by 33%. Close behind, 32% want AI-assisted detection and investigation tools they can trust.
At the aggregate level, 69% want improvements to security operations, 66% want better prevention and incident readiness, and 64% identify people and capability needs. These priorities are complementary: Better technology delivers the greatest value when teams have the skills, time, and authority to use it effectively.
The emerging model for incident response is AI-supported and human-led
The findings provide a clear picture of how organizations currently want humans and AI to work together.
Over two-thirds (69%) follow a shared decision-making model, where AI helps teams process information, investigate activity, and recommend responses, but people retain responsibility for context, judgement, and final decisions.
For 41% of respondents, automated or AI systems recommend actions, but people make the final decisions. For a further 28%, it is the human responders who lead investigations with support from AI or automation. The proportions are different for the largest organizations surveyed. In organizations with 1,500 to 2,000 employees, 35% rely on automated systems supported by human decision makers — while 34% expect human responders to lead the investigation supported by AI.
This highlights how AI is shifting the skill set needed by security professionals. Instead of technical alert triage, they must be able to understand the evidence behind an AI-generated recommendation, judge its reliability, assess its likely business impact, and decide whether action is proportionate.
AI is reshaping security roles and head count
Most of the organizations surveyed (79%) are already seeing an impact from AI on security head count or roles. Over half (56%) have experienced some form of workforce reduction, with an even split between the loss of entry-level security and higher-level roles.
In other words, the findings show that organizations are using AI to reshape or reduce security head count, while simultaneously needing more advanced professional expertise to govern AI, investigate complex attacks, manage incidents, and make high-consequence decisions.
What this means for the evolution of the cybersecurity profession
The cybersecurity profession appears to be moving away from expertise in discrete technical tasks and towards a multilayered role built around judgement, orchestration, and accountability.
Over the next year, AI and automation are likely to take on more routine analysis, correlation, and recommendation work. Human roles will increasingly concentrate on the areas where the findings show the greatest unmet need:
Interpreting subtle, identity-led, and malware-free attacks
Validating AI-generated findings and recommendations
Making rapid decisions under pressure
Coordinating response and maintaining business operations
Governing the use of AI and automation
Prioritizing long-term risk
Explaining technical exposure in business terms
Ensuring that systems remain subject to meaningful human oversight
This has implications for career development. If entry-level activities are automated or roles are removed, organizations will need alternative ways to give newer professionals the practical experience required to become future investigators, incident leaders, and security decision-makers. Reducing foundational roles without creating new development pathways could deepen the advanced skills shortages that organizations already report.
The definition of a senior security professional is also expanding. Technical depth remains essential, but it increasingly needs to be combined with AI literacy, identity expertise, business continuity awareness, communication skills, and an understanding of governance and organizational risk.
Next steps for cybersecurity management
For cybersecurity leaders, the findings suggest that the answer is not a binary choice between hiring people and deploying AI. The more effective approach is to redesign security management around the combination of skilled people, trusted technology, and clear accountability.
That means:
1
Treating the professional challenge as a capability portfolio, not simply a vacancy count.
Leaders need to understand where they lack technical expertise, decision-making capacity, business knowledge, governance skills, and resilience capability.
2
Investing in visibility and integration before adding more complexity.
Teams cannot respond effectively if relevant evidence remains fragmented across identity, email, cloud, applications, data, and endpoints.
3
Using AI to augment constrained teams, with explicit human oversight.
Responsibilities should be clear: what AI may recommend, what it may perform automatically, when a person must approve action, and who remains accountable.
4
Protecting time for prevention, preparation, and learning.
A perpetually reactive team cannot keep pace with evolving AI and identity threats, regardless of the tools available to it.
5
Developing resilience across the full incident lifecycle.
Skills investment must cover detection and response, but also business continuity, recovery, remediation, and post-incident improvement.
6
Building stronger links between security and business leadership.
Executives need to understand the operational consequences of cyber risk, while security teams need to connect technical decisions to business priorities.
The survey findings show that AI is changing cybersecurity faster than many organizations can adapt their professional capabilities.
AI is helping attackers create more targeted threats, introducing new business-governance demands, reshaping security roles, and becoming embedded in incident response. At the same time, security teams are expected to support expanding digital operations with constrained resources, fragmented visibility, and limited time for prevention.
The future cybersecurity function will therefore not be defined by head count or technology alone. It will depend on whether organizations can combine AI-enabled scale with human judgement, broad security visibility, resilient operations, and clear accountability.
In an AI-powered world, the most valuable security teams will not simply be those that can operate more tools or process more alerts. They will be those that can understand complex threats, challenge automated conclusions, make confident decisions under pressure, and keep the business operating when disruption occurs.
