Cybersecurity hiring practices leave little room for junior talent

Twenty-minute training sessions that fit into the workweek could help new hires become productive sooner, keep employees’ skills current and build problem-solving skills they can use across different tools, according to SkillBit’s The Shift to Continuous Cybersecurity Micro-Training report.

Reasons for missing development goals (Source:SkillBit)

More than 80% of executives surveyed used their full 2025 training budgets. Experience requirements can limit the pool of junior cybersecurity candidates. Seventy percent of organizations have no junior roles, or very few, that they can fill with candidates who have less than two years of experience. Thirty percent of leaders said they were receptive to using interactive labs in place of experience credentials, while another 49.5% were open to the idea if shown evidence that it works.

57% of executives reported that new hires take an average of six months to reach full proficiency. General IT knowledge and cybersecurity processes were the most cited causes of delays. Shortening the time to proficiency could reduce costs and improve team readiness.

Seventy-one percent of security leaders said they would prefer 20-minute online or interactive sessions each week to training that requires 30 to 40 hours once or twice a year.

Urgent daily tasks are a leading reason employees miss development goals. Respondents also cited too much vendor training, time away from the office, concerns about wasting time and training they do not enjoy

Skills decay affects team readiness

Thirty-nine percent of respondents said their teams face skills decay, rising to 60% at companies with at least 50,000 employees. Of those who identified the problem, 75% called its impact a “moderate irritation.” They said it can weaken team readiness and morale, raise training costs, make staff harder to assign and leave important tasks unattended.

About two-thirds of respondents favored problem-solving skills that apply across technology stacks over expertise in a specific set of tools. Leaders also valued curiosity about technical problems, proactive learning, forensic skills and knowledge of their organization’s environment.

Readiness reports lack a common measure

Asked about their ability to provide objective data on team readiness, 59% of executives said they were somewhat confident and 37% said they were extremely confident.

Executives reported similar confidence in identifying employees with potential for specialized roles. Sixty-five percent were somewhat confident and 33% were extremely confident.

Security leaders use different measures to report organizational readiness to their boards. Some cited “personal observation,” “trust” and “anecdotal notes.” One respondent said their board “tends to not want a full update unless something has happened.”

The industry lacks a common standard for measuring readiness, so board reports often combine audit results, performance reviews and certification counts, which may not show whether a team can stop an active breach.