.svg)
The cybersecurity industry has spent years talking about its talent shortage. organisations struggle to fill critical roles, existing teams are stretched thin, and the growing complexity of cyber threats is only increasing demand for skilled professionals. Yet, while employers say they desperately need talent, they're making it harder for new talent to get through the door.
The UK Government's recently published Digital and Technologies Jobs Plan highlights a particularly troubling statistic: the percentage of cybersecurity job adverts open to candidates with less than a year's experience fell from 25% in 2022 to just 16% in 2025. Meanwhile, 64% of cyber job postings in 2025 required between two and six years of experience.
This creates an obvious contradiction. We need more cybersecurity professionals, but we're increasingly unwilling to hire people who haven't already been cybersecurity professionals.
The government's plan sets out an ambition to create 200,000 entry-level opportunities over the next decade, alongside a projected need to fill 800,000 digital and technology roles. It's an important step, but creating opportunities is only part of the equation. Employers also need to rethink how they determine whether someone is qualified to fill them.
The industry's challenge isn't simply finding more talent. It's finding better ways to recognise capability.
Experience doesn't always equal ability
Years of experience have become a convenient shorthand for competence. They're easy to include in a job description, straightforward for recruiters to screen against, and offer hiring managers some reassurance that a candidate knows what they're doing.
But time spent in a role doesn't necessarily tell us how effectively someone will perform when confronted with a real cybersecurity challenge.
Consider two candidates. One has spent five years in a security role but has limited experience responding to sophisticated attacks. Another is a recent graduate or career changer who has developed strong practical skills through hands-on exercises and demonstrated an ability to investigate threats, make decisions and adapt under pressure.
The first candidate will likely make it through an initial CV screening. The second may never get an interview. That's a missed opportunity, both for employers and for people trying to enter the profession.
This isn't an argument for disregarding experience. Experienced professionals bring valuable judgment, institutional knowledge and lessons learned from real-world incidents. But experience should be one indicator of capability, not the sole qualification that determines whether someone deserves consideration.
From credentials to demonstrated capability
One of the biggest barriers to hiring less experienced cybersecurity professionals is confidence. Employers need to know that the people they're bringing into their organisations have the foundational skills to perform effectively. The answer isn't to lower hiring standards. It's to measure those standards differently.
Practical, scenario-based assessments can give employers objective evidence of what candidates can actually do. Rather than relying exclusively on qualifications, certifications or previous job titles, organisations can evaluate how individuals approach realistic security challenges, identify vulnerabilities, investigate incidents and apply their knowledge.
This creates opportunities for talented individuals whose capabilities might otherwise be overlooked, including career changers, people from nontraditional educational backgrounds and candidates from underrepresented communities.
It also gives employers something more meaningful than assumptions based on a CV: evidence. Importantly, this approach shouldn't end when someone is hired. The same principles can be used to identify skills gaps, provide targeted development opportunities and continuously validate whether employees are prepared for the threats they're expected to handle.
AI is raising the stakes
The urgency of this challenge becomes even clearer when we consider how rapidly cybersecurity itself is changing.
The UK's National Cyber Security Centre recently introduced a new AI chapter in its Research Problem Book, highlighting how increasingly autonomous AI systems are reshaping cyber defence, creating new security challenges and changing the relationship between human judgment and automated decision-making.
As AI accelerates the speed and scale of cyber threats, organisations will need professionals who can do more than demonstrate familiarity with established tools and processes. They'll need people who can adapt, exercise sound judgment, work effectively alongside AI systems and respond to unfamiliar situations.
These aren't capabilities that can be reliably measured by years of employment alone. And the skills required today may not be sufficient tomorrow. That makes continuous, hands-on skills development and assessment essential, not just for people entering the industry, but for experienced professionals whose responsibilities are evolving alongside the threat landscape.
It also presents an opportunity to rethink entry-level roles. Rather than eliminating junior positions as AI automates routine work, organisations should consider how those roles can evolve to develop the human skills that become increasingly valuable as automation advances.
Turning workforce ambitions into measurable outcomes
The government's focus on skills development also has implications beyond recruitment.
Under the updated public procurement Social Value Model, the minimum social value weighting for applicable central government contracts worth £5 million or more will increase to 20% from January 2027. The emphasis includes creating employment opportunities, developing skills and helping people overcome barriers to entering the workforce.
This creates an opportunity for public sector suppliers to demonstrate meaningful workforce development rather than simply making commitments to training. But the same principle should apply across the private sector.
The effectiveness of a workforce development program shouldn't be measured solely by how many people complete a course or earn a certificate. It should also be measured by whether participants develop demonstrable capabilities, improve their performance and become better prepared to meet real-world challenges.
For organisations investing in apprenticeships, early-career programs or internal upskilling initiatives, that distinction matters. It connects investment in people to measurable outcomes for both the individual and the organisation.
It's time to change the question
The cybersecurity talent shortage won't be solved by government initiatives alone. Employers have an equally important role to play in removing unnecessary barriers, creating meaningful pathways into the profession and investing in the development of their existing teams.
That requires challenging some long-standing assumptions about what makes someone qualified.
We should be asking less about how many years someone has worked in cybersecurity and more about what they can actually do. Can they identify a threat? Investigate an incident? Make effective decisions under pressure? Recognise when AI-generated recommendations require human intervention? These are the questions that matter when it comes to building a capable, resilient cybersecurity workforce.
The UK's Digital and Technologies Jobs Plan is an important recognition that the industry needs to open more doors. But opening those doors will only make a difference if employers are willing to change how they evaluate the people standing outside them.
The future of cybersecurity depends on our ability to identify, develop and validate talent, not simply count its years of experience.
Building a future-ready cyber workforce with Immersive
Ready to transform your organisation's approach to cybersecurity talent? Immersive helps organisations move beyond arbitrary experience requirements by providing evidence-based capability assessments, dynamic threat labs, and crisis simulations. Whether you are aligning with the UK’s Digital and Technologies Jobs Plan, looking to support non-traditional entry pathways, or seeking to continuously benchmark workforce resilience, our platform gives you the data and confidence to build, validate, and scale your cyber workforce strategy.
To discover how Immersive can help you build and prove your cybersecurity talent strategy, visit immersivelabs.com or reach out to our team today.
