The Agency Share of UK Core Cyber Adverts Fell to 26%. In the Same Year, Core Postings Rose 7%.
7 November 2026
The share of UK core cyber security job postings advertised through a recruitment agency has fallen across the last three waves of the government's own study, from 42% to 33% to 26%. In 2024 that was easy to explain, because the market contracted by roughly a third. In 2025 it is not, because postings rose 7% and the share fell again. Whatever work the agency fee used to pay for did not stop being necessary. It moved, and it moved onto no budget line at all.
What the data shows
The Department for Science, Innovation and Technology published Cyber security skills in the UK labour market 2026 on 29 September 2026, with Ipsos and Perspective Economics. Its vacancy analysis draws on 354,786 Lightcast postings across all cyber roles from January 2022 to December 2025, of which 66,964 fell in 2025; the core cyber subset runs to 184,434, with 34,932 in 2025. Survey fieldwork ran from 8 August to 27 October 2025, with 51 qualitative interviews conducted separately between 15 September and 1 December 2025.
In the demand chapter sits a three-year series that has had little attention. In DSIT's words, the proportion of job postings advertised through a recruitment agency "appears to have continued to decline, from 42% in 2023, 33% in 2024, to 26% in 2025". The department hedges the direction with "appears to have", and that hedge is worth keeping.
The sequencing is what makes it interesting.
Core cyber postings fell 33% in 2024, from 48,492 in 2023 to 32,671. A falling agency share in a contracting market is unremarkable: hiring stops, and agency briefs stop first. In 2025 the direction reversed. Postings rose 7% to 34,932, an average of 2,911 a month, and all cyber roles reached 66,964, up 10%. Demand recovered, and the agency-advertised share fell a further seven percentage points.
A note on what that series measures, because the distinction decides how far it can be pushed. DSIT reports the share of postings advertised through an agency, not the share of hires made through one. It also reports the share against those core cyber postings for which sector data could be identified, rather than against the full 34,932: the 26% sits beside a stated remainder of 20,406 roles, implying a base of roughly 27,600. The absolute number of roles moving away from agency advertising therefore cannot be derived from the report.
Three other findings in the same study sit alongside it.
Turnover is at the top of its published range. An estimated 14% of people working in the cyber security sector were reported to have left their role in the eighteen months before the survey. That 14% comprises 9% who left voluntarily, 3% through redundancy and 1% each through dismissal and retirement. Across the five years for which DSIT publishes the comparison the series reads 14%, 12%, 11%, 11% and 11%. The department states plainly that these changes are not statistically significant and that the estimates should be read as lower bounds, because staff who joined and left inside the window are excluded. Both caveats are material, and neither points downwards.
Skills gaps remain elevated. Among cyber sector firms, 24% reported that a technical skills gap among existing employees affected their ability to meet business goals, rising to 38% when the same firms were asked about job applicants who lacked the skills they needed. On the existing-employee measure that is up from 18% in 2021, though down from a peak of 28% in the 2025 study. In the qualitative interviews, employers described CVs that appeared to have been written by AI and candidates overclaiming their abilities. A small number described losing candidates to better offers shortly before they were due to start.
The entry route continues to narrow. Postings requiring under a year of experience stood at 16% in 2025, against 17% in 2024 and 25% in 2022, though DSIT notes over 70% of postings do not contain sufficient text on experience. Cyber apprenticeship starts in England fell 15% in 2024/25, from 590 to 500, with the UK figure likely slightly higher. Among cyber sector firms, 28% offered apprenticeships and 17% a graduate scheme or entry pathway.
One external study sits alongside the government data, on a different population from DSIT's.
The 2026 Barclay Simpson Salary Survey and Recruitment Trends Guide: Cyber Security surveys cyber security professionals and their employers. Some 88% of employers said finding skilled talent was challenging. Asked to select every challenge that applied, they named compensation (83%), insufficient technical or regulatory knowledge (56%), remote working policies (44%) and poor cultural fit (32%). On artificial intelligence, 63% use it for CV screening and shortlisting; asked about AI's impact on recruitment, 74% named the integrity of information on CVs as a concern, and half said AI had not made recruitment more efficient or effective. These are multi-select figures, so they neither sum nor form a ranking.
Why this one is different
Much commentary on the cyber skills shortage argues about supply. This series is about the advertising route, and by inference about who performs the work of filtering and whether anybody is measuring it.
Advertising directly rather than through an agency is a legitimate and often sensible decision. Fees are visible, negotiated annually, and a finance director can challenge them. The point is narrower. Sourcing, sifting and candidate management are tasks, not line items, and they do not disappear when the external route is used less. They reappear on the calendars of a security engineering manager, a head of security operations and a CISO: the people whose time was already the binding constraint on the control environment.
That reappearance is seldom priced. An agency fee sits on a cost line and gets challenged each year. Internal sift time is rarely recorded at all. Absorbed inside salaries already paid, it reads as free. It is not. It is work done by expensive people hired to do something else, with no record of how long it took or how well it was done.
Three findings in the current data suggest the absorption is not going smoothly.
First, the evidence problem. When 63% of employers screen CVs with AI, and 74% name the integrity of information on CVs as a concern about what AI is doing to recruitment, the filter and the thing being filtered are moving in the same direction at once. An automated sift applied to applications that employers already distrust does not produce a judgement. It produces a shortlist whose provenance nobody can describe.
Second, late-stage loss. Losing a candidate to a better offer shortly before the start date is among the most expensive failure modes in hiring: the full cost of the process has been incurred and the seat is still empty. It is also the mode most sensitive to process speed and to who owns the candidate relationship between offer and start. DSIT records it from a small number of employers only, so treat it as an illustration rather than a measured incidence.
Third, the narrowing base. Entry-level demand is down, apprenticeship starts are down, and fewer than one in five cyber sector firms runs a graduate scheme. An organisation advertising more of its roles directly while building no internal pipeline has not changed its hiring strategy. It has removed half of it.
None of this says an external recruiter outperforms a direct hire. Plenty of direct hires are better, faster and cheaper, particularly where the internal referral network is strong. It says that a decision taken on the visible cost has consequences on costs nobody is recording, and that the recording is the part within a board's gift to fix.
The commercial exposure
Regulatory. The duty to resource and to train sits differently under the two instruments most often cited, and the difference matters.
Under DORA, which binds financial entities and, separately, their ICT third-party service providers, Article 5(2) places on the management body the duty to define, approve, oversee and be responsible for the implementation of all arrangements related to the ICT risk management framework, and to bear ultimate responsibility for managing ICT risk. The same paragraph requires it to allocate and periodically review the appropriate budget to meet the entity's digital operational resilience needs, covering all resource types including staff training and ICT skills. Article 5(4) requires members of the management body to actively keep up to date with sufficient knowledge and skills to understand and assess ICT risk, including by following specific training on a regular basis, commensurate to the ICT risk being managed. The resourcing duty is written into the text.
NIS2 is narrower on resourcing and should not be read across. Article 20(1) requires Member States to ensure that the management bodies of essential and important entities approve the cyber security risk-management measures taken under Article 21, oversee their implementation, and can be held liable for infringements of that Article. Article 20(2) requires Member States to ensure that members of those management bodies follow training, and to encourage entities to offer similar training to employees on a regular basis. There is no budget or staffing obligation in Article 20 itself.
In the UK, the Cyber Security and Resilience Bill is before Parliament and is not yet law. Its arrival would not create a resourcing duty of this kind, though it would be likely to increase the number of questions asked about how security functions are staffed.
Financial. The cost of an unfilled security role is not the salary saved. It is the controls that go unoperated while the seat is empty, the senior hours consumed by the search, and the premium often paid late in the process to close a candidate holding a competing offer. Cyber insurers commonly ask proposal-form questions about staffing, named responsibilities and monitoring coverage. An answer given on an approved headcount rather than an occupied seat is the kind of inaccuracy that surfaces at claim stage.
Contractual. Enterprise security schedules and supplier assurance questionnaires routinely require named roles, defined responsibilities and stated coverage hours. A long vacancy in a named role is a contractual question before it is an operational one, and it surfaces in the buyer's annual review rather than at a convenient moment. The same applies in transaction diligence, where a security function carrying open roles and recent departures is read as execution risk and priced accordingly.
Governance. Reported turnover of 14% is not, on DSIT's own caveat, a statistically significant movement. It is still better treated as a reporting question than as a labour market statistic. If a security function loses people at around that rate and the board sees only the headcount it approved, it is being shown an intention rather than a position. An approved role is a plan. A filled role is a capability.
What leaders should do now: the Sift Ledger
The remedy is not to reinstate agency spend. It is to put the hidden work on a page. Four entries, each a number, reviewed where the risk committee already meets.
1. Volume. How many applications did the last three security vacancies attract, who read them, and how many senior hours did that consume? Book the hours against the requisition. A sift costing 40 hours of a head of security operations' time is a decision, not an overhead, and should be visible as one before the next requisition is approved.
2. Verification. For every shortlist, record which claims were tested and by whom. A practical standard: no candidate reaches a final interview without one skill demonstrated under observation rather than described. In a market where most employers screen with AI and most name CV integrity as a concern, a shortlist is hard to defend unless somebody can name the test.
3. Velocity. Measure one number: calendar days from requisition approval to start date. Not time to offer, which flatters, and not stage averages, which conceal. Late-stage candidate loss is a velocity failure before it is a compensation failure, and velocity is largely within an employer's own control.
4. Vacancy. For each open security role, name the controls that are not being operated while it is open, and have the accountable executive accept that exposure in writing, with a review date. This converts an empty seat from an administrative state into a recorded risk decision, which is what it already is.
The ledger is audited by one figure at twelve months: how many of last year's security hires are still in post. Set against a sector series running 11%, 11%, 11%, 12%, 14%, that figure tells a board more about the quality of its hiring than any cost-per-hire calculation will.
Three questions for leadership
- How many applications did our last security vacancy attract, who read them, and what did that cost in senior hours we did not book anywhere?
- On our current shortlist, which claims have been tested rather than stated, and who performed the test?
- Which controls went unoperated between the approval date and the start date of our last security hire, and who accepted that exposure in writing?
An executive team that cannot answer the first two has not brought hiring in-house. It has stopped measuring it.
The strategic takeaway
Advertising more roles directly is a reasonable response to a visible cost. Doing it without moving the measurement inside at the same time is not a saving. It is a transfer from a line item that gets challenged to one that does not exist.
What the 2026 data establishes is narrower than the argument built on it. A smaller share of core cyber postings is advertised through agencies, and in 2025 that happened while demand grew rather than shrank. Reported departures are at the top of their published range, on figures DSIT itself calls not statistically significant. Three quarters of employers in a separate survey name CV integrity as an AI-related concern. The link between those three is an argument, not a finding.
Security capability is not the headcount a board approves. It is the headcount in post, with somebody able to say how each person was assessed and how long the seat stood empty. The Sift Ledger turns that into four numbers, and all four are cheap to collect.
Confidence note
Confirmed. The agency-advertised share of UK core cyber postings at 42% in 2023, 33% in 2024 and 26% in 2025, reported against those postings with identifiable sector data; core cyber postings of 48,492 in 2023, 32,671 in 2024 (a fall DSIT states as 33%) and 34,932 in 2025 (a rise DSIT states as 7%); all cyber postings of 66,964 in 2025, up 10% on 60,992; a vacancy analysis base of 354,786 postings from January 2022 to December 2025, with a core cyber subset of 184,434; reported sector turnover of 14% in the current report against 12%, 11%, 11% and 11% in the four prior years, comprising 9% voluntary, 3% redundancy, 1% dismissal and 1% retirement over an eighteen-month window; postings requiring under one year of experience at 16% in 2025, 17% in 2024 and 25% in 2022; cyber apprenticeship starts in England down 15% in 2024/25, from 590 to 500; 24% of cyber sector firms reporting that a technical skills gap among existing employees affected business goals, rising to 38% on job applicants, against 18% in 2021 and a peak of 28% in the 2025 study. All from DSIT, Cyber security skills in the UK labour market 2026, 29 September 2026. DSIT does not test, or offer any explanation for, the decline in agency-advertised share.
Assessed. That the fall in agency-advertised share represents a transfer of sourcing and screening work onto internal teams is an assessment, not a measured finding. The 2025 data point is what makes the assessment worth making, because a falling share during a growing year cannot be attributed to the market contracting, as the 2024 fall can. The link drawn here between that shift, the level of reported turnover and employer concern about candidate evidence is an argument about causation that the data is consistent with but does not establish.
Not known. DSIT does not state the exact base for the 42%, 33% and 26% series; the 2025 figure implies roughly 27,600 postings against a headline of 34,932, so the absolute number of roles moving away from agency advertising cannot be derived. Barclay Simpson publishes no question wording, states neither its sample size nor its fieldwork dates, and its percentages are multi-select. Several DSIT cyber sector percentages rest on small bases, around 230 firms for neighbouring figures, and the report does not state the base for the 38% and 24% items specifically. No published UK figure was found for applications per cyber vacancy, for internal sift hours, or for calendar days from requisition approval to start in cyber security roles. DORA Article 5(2), including the budget duty at point (g), was checked against the Official Journal text. DORA Article 5(4) and NIS2 Article 20 were checked against secondary reproductions of the Official Journal rather than the Journal itself, and are rendered as paraphrase rather than quotation.
Working with Garzon Cyber Solutions
Garzon Cyber Solutions is a young firm, and precise about what that means. We publish our own research. We have not yet signed a recruitment client or made a placement, and we would rather say so than imply otherwise. Any search would be run by the founder personally rather than passed to a desk.
Recruitment would be delivered on a contingency basis. Nothing would be payable until a candidate accepts an offer and starts. Our terms carry no retainer, no engagement fee, no advertising cost and no charge for an unsuccessful search. No CV would be sent to a hiring company without the candidate's explicit permission for that specific role. We would work on roles across the UK, EU and Americas.
Our ground is cyber security, security compliance and GRC, together with the commercial roles technology companies build around them. It is not anti-money laundering, financial crime operations or pure fintech compliance. For those, a specialist in that niche is likely to beat us, and we will say so rather than accept the instruction.
If the Sift Ledger is useful, take it and run it yourselves. If you would rather discuss a specific open role, or what your security function should look like at its current stage, that conversation starts with the founder.
Jonathan Garzon, Founder and Chief Executive, Garzon Cyber Solutions. For the full series, visit the Garzon Cyber Solutions Website.
Sources: Department for Science, Innovation and Technology, Ipsos and Perspective Economics, Cyber security skills in the UK labour market 2026, 29 September 2026. Barclay Simpson, The 2026 Barclay Simpson Salary Survey and Recruitment Trends Guide: Cyber Security. Regulation (EU) 2022/2554 (DORA), Article 5. Directive (EU) 2022/2555 (NIS2), Article 20. UK Parliament, Cyber Security and Resilience (Network and Information Systems) Bill.