Average Pay Rose 1.1%. The Architects Did Not Get The Average.

Hays puts the average technology salary increase for 2026 at 1.1%. Four of the ten fastest-rising roles in UK technology carry the word architect in the title. The distance between those two facts is the most useful piece of career information a security professional will read this year.

Two findings from the 2026 pay data deserve to be read side by side, because separately they mislead and together they explain almost everything about how the market is now behaving.

The first is that the average technology salary increase has settled at 1.1%, while 79% of technology employers say they expect to increase staff pay over the coming twelve months and 92% report skills gaps. The second is the composition of the roles where pay is actually moving. Data architect. Chief data officer and head of data. Enterprise architect. Cyber security architect. Information security architect. Hays places all of them inside the ten fastest-rising technology roles for 2026.

An average of 1.1% in a market where four in five employers intend to pay more is not a flat market. It is a concentrated one. Money is moving. It is simply not moving evenly, and the direction it has taken is not the direction most career advice still points.

What the sector data actually describes

The DSIT Cyber Security Sectoral Analysis 2026 puts the UK cyber sector workforce at approximately 69,600 full-time equivalents, an increase of 2,300 roles, or 3%, over twelve months. That is the lowest growth rate recorded since the series began in 2018.

In the same period, gross value added per employee rose from £116,200 to £131,200, an increase of 13%. Average cyber security team size fell from 31 staff to 27. In large enterprises, average team size fell from 204 to 180, a reduction of 12%.

Stated plainly: the sector hired very few additional people and extracted considerably more value from the people it already had. Those two movements are the same decision viewed from opposite ends.

The ISC2 Cybersecurity Workforce Study 2025 supplies the mechanism. Some 95% of respondents report at least one skill need, up five points on the previous year. A further 59% describe critical or significant skills gaps, up fifteen points. Most instructive for anyone planning a career, 29% say they cannot afford to hire staff with the skills they need.

That last figure repays a second reading. It is not a statement about a shortage of people. It is a statement about price at the top of the skill curve. Employers are not saying the market is empty. They are saying the part of it they want has become expensive.

The part that looks like a contradiction

The Nash Squared Digital Leadership Report 2025, drawn from 2,015 technology and digital leaders across 62 countries, records AI as the single scarcest technology skill, having climbed from sixth position to first in eighteen months, with 51% of leaders reporting a shortage. Cyber security skills sit at 33%. Enterprise and solution architecture, meanwhile, recorded the largest decline of any skill category.

Set against the Hays ranking, that appears contradictory. Fewer leaders report being short of architects, yet architect pay is rising faster than almost anything else in technology.

It is not a contradiction. The two studies measure different things. Nash Squared counts how many organisations report a shortage. Hays counts what employers actually pay when they hire. A skill can be less widely reported as scarce and still command the sharpest premium, because the shortage has stopped being a shortage of people holding the title.

Scarcity has moved from quantity to quality. There are enough architects. There are not enough good ones, and employers have stopped treating the title as a reliable proxy for the capability.

Why a shrinking market pays more for design

The commercial logic is simpler than it looks, and it turns entirely on what the two kinds of work produce.

An operator's output is consumed at the moment it is produced. A shift covered, a ticket closed, an alert triaged, a control tested. All of it necessary, none of it accumulating. Stop the work and the output stops with it, the same week.

A designer's output persists. A control pattern, an identity model, a segmentation standard, a detection architecture, a compliance mapping built once and reused across three frameworks. It sets the unit cost of every operation that follows it, for years, whether or not the person who designed it is still in the building.

When a team of 31 becomes a team of 27, the organisation has not concluded that four people were unnecessary. It has concluded that it can no longer afford work that does not compound. Value added per head rising 13% is that conclusion appearing in the accounts.

The Design Line

The useful question for a practitioner is therefore not how much experience they have accumulated, nor which certification comes next. It is which side of the design line their working week sits on. Four tests place it.

Decision

Do you determine how something is built, or operate what somebody else determined? Running a well-designed process to a high standard is valuable work. It is priced differently from having designed the process.

Durability

Does your output outlive the shift in which you produced it? If the honest answer is that your week leaves nothing behind but closed tickets, your value resets to zero every Monday and your pay will behave accordingly.

Substitution

If your employer changed tooling vendor next quarter, how much of your value survives the migration? Vendor-specific operating fluency is rented capability. Architectural judgement is owned. The rental market is where the 1.1% lives.

Reach

Does your work set the standard for people you do not manage? Influence without line authority is the clearest available signal that an organisation is buying your judgement rather than your hours.

Nobody needs four affirmative answers. What matters is knowing the honest score, because that score, not the job title, is what the market is currently pricing.

What this means at each stage

Early career

The instruction is not to skip the operating years, which remain the only place technical credibility is built. It is to stop treating them as time served. Every operating role contains design work that nobody has formally claimed: the runbook that does not exist, the alert tuning nobody has documented, the onboarding pattern rebuilt from memory each time. Claiming it converts hours into an asset, and it is the fastest route across the line available without a promotion.

Mid career

This is the hardest position in the current market, because it is where deep operating fluency in a specific stack meets a market paying for the judgement above it. The move that fails is a title change unaccompanied by a change in output. Migrate the work first, then the title. A CV that claims architect and describes an operator is screened out faster than one that claims senior engineer and describes design.

Senior and leadership

The 29% of organisations that cannot afford the skills they need are not short of managers. With average large enterprise teams falling from 204 to 180, leadership priced at the top of this market is technical authority that scales, not headcount responsibility. Anyone building a leadership case on span of control is arguing from the one variable the sector is actively reducing.

Governance, risk and compliance

The line applies here with no modification. DSIT reports that 49% of UK businesses struggle with basic technical cyber tasks and 30% report gaps in advanced skills such as penetration testing and forensic analysis. In compliance, the operator evidences a control. The designer builds a control set that satisfies ISO 27001, SOC 2 and DORA from one piece of work rather than three. That is architecture, whatever the job title says, and it is priced as architecture once it is visible.

Three questions worth answering honestly

1. If I left my employer on Friday, what would still be running on Monday because I designed it?

2. What proportion of my expertise is portable across vendors, and what proportion is a licence to operate one product well?

3. Where in my current role is the design work nobody has claimed, and what is actually stopping me from claiming it?

The strategic takeaway

The market has not stopped paying. It has stopped paying evenly, and it has been explicit about where the money went. Fewer seats, more value per seat, and the sharpest increases concentrated in roles that decide how something gets built rather than roles that run it once built.

For a practitioner, that reframes the entire career question. The variable to manage is not seniority, tenure or certification count. It is the proportion of your working week that produces something which outlives the week. Average pay rose 1.1%. The average is now a poor description of anybody's actual position, and the people it describes least are the ones who moved above the line.

Confidence note

The salary growth ranking and the 1.1% average are Hays' own findings from its 2026 UK Salary and Recruiting Trends guide, an employer survey; GCS has not independently verified the underlying pay data. The DSIT sectoral analysis figures are statistical estimates derived from a firm-level survey. The ISC2 and Nash Squared figures are self-reported by practitioners and technology leaders respectively, and carry the limitations that survey design implies. The interpretation set out above, including the design line framing, is our assessment and is not a finding of any source cited.

Where GCS fits

Garzon Cyber Solutions is a young firm. We have not been running for years and we do not pretend otherwise. What sits behind the recruitment side is a career spent inside cybersecurity and compliance, selling to security and technology buyers and working alongside the marketing and technical colleagues who built and sold with me. That is why the briefs we take are cybersecurity, security compliance and GRC, plus the commercial roles technology companies build around them. Where a brief sits outside that, we say so rather than take it.

If you are a cybersecurity, GRC, cloud or technology professional and you want to be considered as roles come in, register your interest. Recruitment here runs on contingency, nothing is payable by a hiring company until a candidate accepts and starts, and no CV goes anywhere without your explicit permission for that specific role. The founder runs this work personally, so the conversation you have is with the person who will represent you.

Garzon Cyber Solutions delivers cybersecurity advisory, compliance certification, and specialist technology recruitment as one integrated capability for organisations scaling into enterprise markets.