Demand Fell 51%. At Six to Nine Years, It Fell 23%.

The government's 2026 cyber security labour market figures look, in aggregate, like a market cooling. Core cyber job postings are down by half since 2022, fewer firms expect to grow, and employers report being buried in applications. Read at that resolution, hiring risk is receding. The breakdown says something narrower and more useful. The contraction is concentrated at the junior and mid bands and is roughly half as deep at six to nine years of experience, while among cyber security firms reporting hard-to-fill vacancies the share struggling at that same band rose from 16% to 35% in a year. The shallowest fall in demand and the one movement DSIT reports in difficulty land on the same band, and the specialisms sitting there are the ones an auditor asks about by name.

What this data measures, and what it does not

Two separate datasets sit inside Cyber security skills in the UK labour market 2026, published by the Department for Science, Innovation and Technology with Ipsos and Perspective Economics on 29 September 2026. Keeping them apart matters, because they describe different populations.

The vacancy analysis, supplied by Lightcast, covers 34,932 core cyber job postings advertised in the UK during calendar year 2025, within a four-year series of about 184,400 core cyber postings. The employer survey covers 230 cyber security sector businesses, meaning the vendors, consultancies and managed service providers that supply and employ most cyber talent. When this briefing cites a survey figure, it describes that supply market rather than an in-house security function at a bank or a manufacturer. That is still the market an in-house function recruits from, which is why it is worth a board's attention, but it is not a measurement of your own team and nothing here should be read as one.

DSIT attaches its own caution to the experience data, and it deserves repeating: more than 70% of postings do not carry enough text to identify a minimum experience requirement, so the experience series is indicative of direction rather than a precise count. The department also notes that some employers may have changed how they secure talent over the period, including their use of external recruitment, which affects what posting data can tell you.

The aggregate picture

On the averages, the market has cooled, and the figures are not in dispute.

Core cyber job postings fell 51% between 2022 and 2025. That fall was concentrated in 2023 and 2024: postings rose 7% in the most recent year, from 32,671 to 34,932, which DSIT reads as demand having begun to recover modestly from the 2024 low. Among cyber security sector businesses, 53% expect to grow their workforce over the next twelve months, down from 67% in the previous study, while 46% expect no change, up from 30%. Among firms that had tried to recruit since January 2024, the average number of vacancies was 4.0, against 8.2 in the 2023 study. The year-on-year move, however, is only from 4.3, and DSIT reads it as a slowdown or an end to the fall rather than a continuation. Turnover across the sector was 14% over the eighteen months before the survey, against 12% in the previous study, a change DSIT flags as not statistically significant.

Applications are abundant. One micro cyber security business told the researchers: "We don't even advertise anymore because we put an advert on LinkedIn, I think we had 1,300 CVs in the first week." Employers described candidates overclaiming on applications and then failing technical assessment.

DSIT's own reading of the averages is explicit. It describes a market "shifting from being a candidate's market to an employer's market", in which employers are "potentially more able to identify and recruit the highest calibre candidates".

That is a fair summary of the aggregate. It is not what the breakdown shows.

The breakdown

Take the 51% fall in postings and split it by the minimum experience requested. Roles asking for under two years fell 53%. Roles asking for three to five years fell 49%. Roles asking for six to nine years fell 23%. Roles asking for ten years or more fell 30%.

The market did not contract evenly. It contracted by about half at the grades where most people are, and by less than a quarter at the six to nine year band.

Now look at the supply side. Among the 66 cyber security businesses that reported any hard-to-fill vacancy, difficulty by grade ran as follows: apprentices 5%, entry level or graduates 23%, experienced or senior staff at around three to five years 56%, principal level at around six to nine years 35%, and director level at ten years or more 11%.

Two things are true at once here, and most commentary picks only one. Difficulty remains most widespread at three to five years, cited by 56% of those firms. But principal level is the only band DSIT reports as having moved, rising from 16% in the previous study to 35%. The department highlights that change in its summary, though it does not describe it as statistically significant, and DSIT publishes no prior-year figure for the other bands, so nothing here supports a claim about which band rose fastest. The 2026 percentages rest on a base of 66 businesses, with the comparator drawn from the equivalent base in the 2025 study, so both are directional rather than precise and should be quoted that way.

Set the two datasets side by side and they meet at the same point from opposite ends. Demand contracted least at six to nine years. The one band DSIT reports as having become harder to fill is six to nine years. Neither figure on its own would carry much weight. Together they describe a market that has cooled least at the band that is hardest to replace.

What those seats actually are

The specialisms matter as much as the grade. Among the same 66 firms, the hardest to fill were governance and risk management at 27%, security testing at 24%, secure system architecture and design at 24%, and audit and assurance at 23%. Secure system architecture and design rose from 10% in the previous study.

Three of those four are assurance and design work. They are the functions that produce the evidence an external party asks for: the control mapping behind a certification, the architecture decision a reviewer questions, the assessment someone has to sign. That work is judgement under scrutiny, and it is the kind of judgement that is difficult to split across two less experienced people and a training plan. In the years I spent selling cyber security and compliance to security and technology buyers, the recurring pattern was that those decisions escalated to one named person, and that person was rarely junior.

The pipeline behind those seats

The experienced bands are fed from below, and the feed is thinning.

Demand for entry-level applicants has fallen in share and in volume. Among the 10,566 core cyber postings in 2025 that state a minimum experience requirement, roles asking for under one year account for 16%, down from 25% in 2022, with two to six years accounting for 64%. In volume terms, postings asking for under two years are down 53% since 2022, slightly steeper than the 51% fall across all core cyber postings.

England's cyber security apprenticeship starts fell 15% in the 2024/25 academic year, from 590 to 500. DSIT also lowered its estimate of the number of people entering the cyber security recruitment pool each year through retraining and certification routes, from 2,500 to 1,500. That revision is a conservative one made because less data was available on conversion course uptake and completion, not a measured fall, and DSIT notes that where new data does exist it shows relative consistency or modest growth. The estimate should be read as a widening of the error bars rather than as evidence of collapse.

The more pointed finding is qualitative. DSIT reports that entry-level positions in security operations centres, long the standard training ground, may be at risk of being displaced as agentic AI takes on more routine tasks, and notes that this was stated more definitively this year than in previous studies. The department's own conclusion is that this "creates a potential pipeline problem, as it limits the flow of junior talent to develop into the senior professionals of the future". Add the demand figures: AI skills were requested in 9% of core cyber postings in 2025, up from 4%, and automation skills in 15%, up from 11%.

An experienced band that far fewer people are feeding today is an experienced band that will be scarcer in five years, whatever the aggregate does in the meantime.

The selection cost nobody has measured

One more shift sits underneath all of this. The share of core cyber postings advertised through a recruitment agency fell from 42% in 2023 to 33% in 2024 and 26% in 2025. DSIT hedges it, saying the share appears to have continued to decline, and it measures advertising channel rather than total hiring activity, so it is evidence of how roles reach the market rather than a complete account of how they are filled. Even hedged, the direction over three years is hard to miss.

It happened in the same period in which application volumes rose, overclaiming was widely reported, and AI-written applications became common enough that employers raised them as an assessment problem in their own right.

The fee moved off the invoice. The work of selection did not disappear with it. It became hiring-manager hours, interview cycles that end in no appointment, and selection error. Garzon Cyber Solutions sells recruitment, so a briefing that concludes employers should use an agency deserves scepticism, and that is not the conclusion here. The narrower claim is the defensible one: no published figure exists for what in-house selection now costs a UK organisation. DSIT does not measure it. We have not found anyone who does. An unmeasured cost is not a saving, and the choice between an agency, a dedicated internal recruiter and a better assessment process should be made on the organisation's own numbers rather than on the absence of a line item.

The commercial exposure

For an organisation carrying a regulatory or contractual obligation, a vacancy in these specialisms creates exposure on four fronts. The first is a matter of law. The other three are an assessment and two inferences, and are labelled as such.

Regulatory. The Cyber Security and Resilience (Network and Information Systems) Bill has completed committee stage in the House of Lords and is scheduled for report stage on 26 October 2026. It has not received Royal Assent, its final obligations are not settled, and no organisation should be planning against a specific duty under it yet. What is already law elsewhere sets the pattern. Under NIS2, Article 20(1) requires Member States to ensure that the management bodies of essential and important entities approve the cyber security risk management measures taken to comply with Article 21, oversee their implementation, and can be held liable for infringements; Article 20(2) requires members of those bodies to undergo training. Under DORA, Article 5(2)(a) requires the management body of a financial entity to bear ultimate responsibility for managing its ICT risk. Both of those duties sit with the board rather than with a practitioner grade. DORA, however, does reach below it: Article 5(3) requires financial entities other than microenterprises to establish a role to monitor arrangements with ICT third-party providers, or to designate a member of senior management as responsible for overseeing that risk exposure, and Article 6(4) requires the responsibility for managing and overseeing ICT risk to be assigned to a control function with an appropriate level of independence. So one instrument names a function below the board, and the other leaves a board to discharge an approve-and-oversee duty on advice. Either way the governance, risk and assurance specialisms that produce that advice are the ones cyber security firms now report as hardest to fill.

Contractual, assessed. Enterprise security questionnaires and supplier assurance reviews commonly ask who owns a control, not only whether the control exists. From the selling side, a questionnaire response that names a person who has since left is the kind of answer that generates a follow-up and stalls a procurement cycle. We have no published measure of how often this happens.

Transactional, inferred. Key-person dependency appears as a standard item on published diligence checklists, and a security or compliance function resting on one practitioner whose judgement is not documented is the kind of dependency those checklists are written to surface. Whether a buyer prices it, and at what, is outside anything we can evidence.

Insurance, inferred. Published cyber insurance proposal forms ask about named accountability and about the controls behind the answer, so a gap at the level that owns both is visible to an underwriter. We have not seen how insurers weigh such a gap at renewal, and we are not claiming to.

The Scarcity Grid

The useful question is not whether the labour market has softened. It is whether it has softened at the grade, in the specialism, and for the duty that applies to a particular seat. Four lines answer that.

Grade. What experience band does the seat genuinely require, judged by the decisions it must make rather than by the title on the advert? Difficulty is most widespread at three to five years, and six to nine is the band DSIT reports as having moved. Seats at those bands should be planned on a different timetable from everything below them.

Specialism. Does the seat sit in governance and risk management, security testing, secure system architecture and design, or audit and assurance? Those four are where reported difficulty clusters. A seat inside them should not be forecast using an average time to hire drawn from the whole function.

Duty. Does anyone outside the organisation ask for the work this seat does? A regulator, an auditor, a customer's third-party risk team, an insurer, an acquirer. Where the answer is yes, the vacancy has an external consequence and belongs on the risk register, not only in the recruitment tracker.

Sift. Who performs selection for this seat, how many hours does it take, and where does that cost appear? If the honest answer is a senior practitioner's evenings and nowhere, the organisation has moved a priced cost into an unpriced one and should decide whether it meant to.

A seat scoring high on Grade, Specialism and Duty is not a vacancy. It is an exposure with a recruitment process attached, and it should be reported, owned and timetabled as one. The Grid is deliberately coarse. Its value is that it forces a distribution onto a conversation that is usually held in averages.

Three questions for the board

1. Of our open and planned security seats, how many sit at or above three years of experience inside one of the four specialisms cyber security firms report as hardest to fill, and for how many of those does an external party ask for the work by name?
2. How many hours did our own managers spend on selection for security roles in the last twelve months, what did that time displace, and where does it appear in any budget?
3. If the most experienced practitioner in our assurance or architecture function resigned this quarter, what is the interval between notice and competent cover, who has agreed that interval is tolerable, and what do we disclose in the meantime?

The strategic takeaway

A cooling market and an acute shortage are not contradictory statements. They describe different parts of the same distribution, and the 2026 data sets the two out clearly: postings down by half overall and by less than a quarter at six to nine years, difficulty widest at three to five years and six to nine the only band DSIT reports as having moved, entry-level demand down in both share and volume while the training ground that feeds everything above it is reported to be at risk of displacement.

Organisations that read the headline will relax their hiring assumptions across the board. Organisations that read the distribution will treat two or three specific seats as governance items with a timetable, and the rest as ordinary recruitment that has genuinely got easier. The second group will spend less, and will know what it is spending.

Confidence note

Confirmed. All figures attributed to DSIT come from Cyber security skills in the UK labour market 2026, published 29 September 2026, with the base stated wherever it is not the whole sample. The grade and specialism breakdowns rest on 66 cyber security businesses reporting hard-to-fill vacancies, and their comparators on the equivalent base in the 2025 study. The 2025 experience-share figures rest on the 10,566 core cyber postings that state a minimum requirement. The 2022 to 2025 change by experience band rests on the 53,023 postings, out of the four-year core cyber series, that stated one. DSIT prints that series as 184,434 in one base note and 184,432 in another, which is why this briefing rounds it. DSIT labels both series indicative. The Cyber Security and Resilience Bill had completed Lords committee stage and was scheduled for report stage on 26 October 2026 according to the UK Parliament website as at 20 October 2026; Parliament marks forward dates as provisional. NIS2 Article 20 and DORA Articles 5 and 6 are described at the level of the enacted text.

Assessed. That demand contracting least at six to nine years and difficulty rising at the same band describe one phenomenon rather than two coincidences is our reading, not a finding DSIT states. The contractual exposure is an assessment drawn from commercial experience on the selling side. The transactional and insurance exposures are inferences from publicly available documents, not from any seat we have occupied, and are labelled as such in the text.

Not known. What in-house selection for security roles now costs UK organisations in management time. No published figure exists, DSIT does not measure it, and none is offered here. Also not known: how much of the fall in agency-advertised postings reflects a change in who fills roles rather than a change in where they are advertised.