Most organizations are running security teams that are too small, too stretched, and missing the skills they now need. That is the headline from Barracuda's Cybersecurity Skills Gap Report, covered by Cybersecurity Insiders on October 29, 2026. Ninety-four percent of the 2,000 IT and security decision-makers surveyed said their organization has a cybersecurity skills gap.
If you run security for a company of 100 to 2,000 people, that number probably matches your week. The useful move is to treat the report as a checklist of where other teams are thin, then check your own team against the same list. Below is that checklist, built only from the gaps Barracuda actually measured.
For background on whether the shortage is real or a hiring-market story, our earlier piece on the cybersecurity skills shortage covers the wider debate. This report adds new detail on which specific skills are missing.
Where are the gaps, exactly?
The survey names three clusters, and each one points to a concrete action.
- AI risk expertise: 68% of respondents reported shortages here. If nobody on your team can explain what AI tools touch your data and where the risks sit, that is your first gap.
- Identity and phishing threats: 67% flagged gaps in advanced identity attacks, specifically business email compromise, OAuth abuse, and multifactor authentication bypass. Business email compromise is when an attacker impersonates a trusted person to trick staff into paying or sharing. OAuth abuse is misuse of the app-permission system that lets third-party tools access your accounts.
- Incident response and judgement: 56% of organizations said they need stronger capabilities in incident response, decision-making under pressure, and risk management.
Notice what is missing from that list: generic firewall knowledge. The gaps are in the newer, judgement-heavy parts of the job, which is harder to hire for and slower to train.
Is my team under-resourced, or just under-organized?
The report gives you a way to tell the difference. Half of respondents said security professionals are expected to support expanding digital operations without additional resources. Forty percent said business expectations exceed their team's capabilities and tools. Thirty-five percent said staffing levels are simply insufficient.
Run those three questions past your own situation. If the answer to the first is yes but the third is no, your problem may be scope, not headcount. If all three are yes, you have a staffing case to take to leadership, and the survey gives you benchmark numbers to argue with.
One more warning sign from the data: 32% of organizations said they can only respond to threats reactively, not proactively. If your team spends every week putting out fires, that statistic is probably you. A reactive posture is often the first visible symptom of the gaps above.
What should I do about AI in my security team?
The survey found 79% of organizations have already changed security roles or head count because of AI adoption. More striking: 56% reported workforce reductions linked to AI, spread evenly between entry-level and senior positions.
That cut both ways, and the report is honest about it. Automation is absorbing routine analysis and response work. But entry-level work is how the next generation of security professionals learns, and the report warns that without structured career development and hands-on training pathways, businesses risk limiting that talent pipeline.
Practically, three steps follow from the findings:
- Map your AI exposure. With 68% short on AI risk expertise, assume you are one of them until someone on the team can name where AI touches your systems and data.
- Keep a human in the decision. The report found 69% of organizations use shared decision-making during incident response: AI assists with investigation and analysis, while people stay accountable for context, judgement, and the final call. That split is a reasonable default to copy.
- Protect a training path. If automation has absorbed your junior team's routine work, replace it deliberately with supervised incident investigation and automation governance, the areas the report says human work is shifting toward.
What skills should I be hiring or training for?
The report describes senior expectations expanding well past technical work. Sixty-one percent of respondents identified a need for strategic security leadership skills, including AI governance and the ability to explain technical risk in business terms. AI literacy, identity security, governance, and communication now sit alongside technical proficiency.
That has a direct budget implication. If you are writing a job description or a training plan, weight it toward identity security and business communication, not just another layer of infrastructure knowledge. If your role includes justifying spend to finance, our guide on what cyber insurance policies cover and demand is one place where translating risk into business terms pays off immediately.
How do I turn this into a plan this quarter?
Here is the checklist, condensed from the report's own findings:
- Ask who on the team owns AI risk. If the answer is nobody, assign it and start with visibility: which AI tools are in use, and who approved them.
- Test your identity defenses against the three named threats: business email compromise, OAuth abuse, and MFA bypass. If you cannot describe how each would play out in your environment, that is the 67% gap.
- Run the three resourcing questions above and write down the answers. They are your evidence for or against a staffing request.
- Check whether your incident response is proactive or reactive. If reactive, prioritize one repeatable process over new tooling.
- Confirm every AI-assisted decision still has a named human accountable for the final call, matching the 69% shared-decision model.
- Give junior staff supervised work that automation has not absorbed, so the pipeline the report worries about stays open.
One caveat worth stating plainly: this is a vendor-commissioned survey. Barracuda sells security products, so treat the numbers as a well-documented snapshot of perceived gaps, not an independent audit of your team. The value is in the specifics, which give you a concrete list to check yourself against.
For more reporting in this area, our Tech News section tracks security spending, hiring, and vendor moves as they land.
