Estimated reading time: 6 minutes · Last updated:
94% of organizations in a new Barracuda Networks survey report a cybersecurity skills gap, and the worst shortfalls sit around AI and identity attacks. The study polled 2,000 IT and security decision-makers. Barracuda Research led it, and the independent firm Arlington Research carried it out for Barracuda. 68% said they lack expertise in AI risk, and 67% said they struggle against advanced identity and phishing threats. AI is also already reshaping the teams meant to close those gaps. 79% of organizations reported AI-related changes to security roles or headcount, and 56% reported security job cuts linked to it. Barracuda sells an AI-enhanced security platform, so the findings deserve scrutiny. The sample is still large and the method is published.
Organizations need to reshape their security teams, combining the power of AI and automation with human expertise, judgement, and visibility.
Siroui Mushegian, Senior Vice President and Chief Information Officer, Barracuda
Key takeaways
- Near-universal gap: 94% of the 2,000 IT and security decision-makers Barracuda surveyed reported a cybersecurity skills gap, with 68% short of AI-risk expertise.
- Identity attacks exposed: 67% of organizations said they lack skills to counter multifactor authentication bypass, OAuth abuse and business email compromise.
- AI is cutting jobs: 56% of organizations reported AI-linked security workforce reductions, split evenly between entry-level and senior posts.
- Humans keep the final call: 69% of organizations use shared decision-making in incident response, with AI assisting and people accountable for judgement.
- Leadership in demand: 61% of respondents need stronger strategic security leadership, including AI governance and explaining risk in business terms.
Table of contents
- Key takeaways
- Where the Cybersecurity Skills Gap Bites Hardest
- Security Teams Are Stretched Before AI Even Arrives
- AI Is Already Changing Security Headcount
- Why Automating Junior Work Threatens the Talent Pipeline
- Who Was Surveyed, and Why the Source Matters
- What could ease or deepen the gap
- What to be careful about
- Frequently asked questions
Where the Cybersecurity Skills Gap Bites Hardest
The headline figure is broad. 94% of the organizations Barracuda surveyed said they have a cybersecurity skills gap of some kind. The more useful numbers sit beneath it. In Barracuda's data, AI risk is the most widely cited shortfall, with 68% of respondents saying their teams lack the expertise to manage it.
Close behind, 67% pointed to weak defences against advanced identity and phishing threats. Barracuda grouped three techniques under that heading: multifactor authentication bypass, OAuth abuse and business email compromise. Business email compromise is fraud in which an attacker poses as an executive or supplier by email to redirect money or data. OAuth abuse exploits the permission tokens that let apps reach an account without a password. MFA bypass defeats the second login check meant to stop stolen credentials.
Taken together, the two figures put the sharpest shortages in the newer parts of the job: governing AI and protecting identities. By their own account, many respondents have not yet caught up in either area.
Security Teams Are Stretched Before AI Even Arrives
Resourcing is the second theme. Half of respondents said security staff must support a growing digital footprint without any extra resources. 40% said the business expects more than their teams and tools can deliver, and 35% said they simply do not have enough people.
The strain shows up in day-to-day operations. A further 67% reported trouble growing their teams fast enough to keep pace with shifting business needs. That is a separate measure from the 67% who flagged identity-threat gaps. And 32% said their organizations can only work reactively, responding to threats as they arrive rather than getting ahead of them.
These figures describe a capacity problem as much as a skills problem. A team that cannot hire is usually also a team with little time to train. That may help explain why specialist gaps such as AI risk persist.
AI Is Already Changing Security Headcount
Barracuda's survey suggests AI is now a present-day workforce question. 79% of organizations said adopting AI had changed security roles or headcount, and 56% reported security workforce reductions linked to AI.
The cuts were not confined to junior staff. Barracuda found the reductions split evenly between entry-level and more senior posts. Seniority offered no particular protection in this sample.
Humans have not left the loop, though. 69% of organizations said they use shared decision-making during incident response, the process of detecting, containing and recovering from a breach. In that model, AI helps with investigation and analysis. Security professionals keep responsibility for context, judgement and the final decision.
Why Automating Junior Work Threatens the Talent Pipeline
Consolidated platforms and automation now absorb more routine analysis and response. Barracuda says human work is shifting toward threat investigation, incident leadership, governing automation and managing business risk. 56% of organizations said they need stronger capability in risk management, incident response and decision-making under pressure. That is a different 56% from the share reporting AI-linked cuts.
This creates a pipeline problem. The tasks being automated are the ones that have traditionally trained entry-level professionals. Barracuda warns that businesses could stunt the next generation of security talent unless they offer structured career development and practical training routes. Siroui Mushegian, Barracuda's Senior Vice President and Chief Information Officer, said: "We must nurture these critical skills in the next generation of cybersecurity professionals, building new development pathways and opportunities for hands-on experience."
Senior roles are widening too. Technical skill remains the baseline. Barracuda's data show employers also want AI literacy, identity security, governance and communication, because security is now a board-level issue. 61% said they need stronger strategic security leadership, such as governing AI and translating technical risk into business impact.
Who Was Surveyed, and Why the Source Matters
Barracuda commissioned Arlington Research, an independent research firm, to run the survey. It covered 2,000 mid- and senior-level decision-makers in IT and security at organizations with 100 to 2,000 employees across several industries. Respondents were asked about skills shortages and capability problems over the previous 12 months.
The respondents came from the United States, the United Kingdom, France, Australia, India and Japan. Three regional groupings were also included: DACH (Germany, Austria and Switzerland), Benelux (Belgium, the Netherlands and Luxembourg) and the Nordics (Denmark, Finland, Norway and Sweden). Very small firms and the biggest enterprises fall outside the sample.
Readers should weigh who paid for the work. Barracuda sells BarracudaONE, a platform it promotes as enhanced by AI and spanning email, identities, data, applications, networks and managed XDR. A conclusion that teams need AI and automation working alongside people suits that business. The figures are also self-reported, so they measure gaps as decision-makers perceive them rather than tested competence.
| Finding | Share of respondents | Theme |
|---|---|---|
| Report any cybersecurity skills gap | 94% | Skills |
| Lack AI-risk expertise | 68% | Skills |
| Gaps on identity and phishing threats | 67% | Skills |
| Struggle to scale teams | 67% | Capacity |
| Must support growth without extra resources | Half | Capacity |
| Expectations exceed capabilities and tools | 40% | Capacity |
| Staffing insufficient | 35% | Capacity |
| Only able to respond reactively | 32% | Operations |
| AI changed security roles or headcount | 79% | Workforce |
| AI-linked security workforce cuts | 56% | Workforce |
| Shared human-AI incident decisions | 69% | Operations |
| Need stronger incident response and risk skills | 56% | Skills |
| Need strategic security leadership | 61% | Leadership |
What could ease or deepen the gap
The case for
- 69% of organizations keep humans accountable for final incident decisions, which preserves demand for judgement and context.
- Demand for advanced skills is explicit: 61% seek strategic leadership and 56% want stronger incident response and risk management, which gives professionals a clear target.
- Mushegian has called for new development pathways and hands-on experience, which is a stated priority from a vendor CIO.
The case against
- 56% of organizations reported AI-linked security cuts, spread evenly across junior and senior roles.
- Automation of entry-level tasks removes the work through which new analysts have traditionally learned.
- 32% of organizations can only work reactively, and 35% say staffing falls short of demand.
What to be careful about
- Organizations with the 67% identity-threat gap remain exposed to business email compromise, OAuth abuse and multifactor authentication bypass.
- If junior roles keep shrinking, the 61% seeking strategic leaders may find fewer experienced candidates in future.
- Security teams that only respond reactively, as 32% reported, have limited capacity to find threats before damage occurs.
- The data come from a vendor-commissioned, self-reported survey and may not reflect measured capability.
The bottom line
Barracuda's survey makes two arguments at once. The first is that the cybersecurity skills gap is close to universal among mid-sized organizations, at 94%. It is sharpest around AI risk and identity attacks. The second is that AI is already thinning security teams, with 56% reporting cuts. Meanwhile, the work left for people is getting harder: incident leadership, governance and explaining risk to boards. The tension between those findings is the real story. If automation removes the junior roles where people learned the trade, the 61% seeking strategic leaders may find fewer candidates ready. The same goes for the 56% wanting stronger incident response. The data are self-reported and vendor-commissioned, but the direction is hard to dismiss.
What to watch
- Watch for Barracuda or Arlington Research to publish country or industry breakdowns of the 2,000 responses; no date has been set.
- Watch whether organizations reporting AI-linked security cuts create the structured training routes Barracuda is calling for; no timetable has been announced.
Frequently asked questions
What skills should cybersecurity professionals build as AI spreads?
Barracuda's survey points to AI literacy, identity security, governance and communication, along with incident response and risk management. 61% of organizations said they need strategic security leadership, including the ability to explain technical risk in business terms.
Are senior security staff safe from AI job cuts?
Not in Barracuda's sample. 56% of organizations reported AI-linked security workforce reductions, and those cuts were split evenly between entry-level and more senior positions.
How reliable is the Barracuda skills gap survey?
Arlington Research, an independent firm, ran it for Barracuda with 2,000 mid- and senior-level decision-makers at organizations of 100 to 2,000 employees. The answers are self-reported. Barracuda also sells an AI-enhanced security platform, so readers should keep that interest in mind.
Related reading
