Barracuda Networks released the Cybersecurity Skills Gap Report, showing how AI, identity-based attacks, and expanding digital operations are pressuring cybersecurity teams. Almost all respondents (94%) report cybersecurity skills gaps, with the most common challenges linked to AI-related risks (68%) and advanced identity and phishing threats (67%), including business email compromise, OAuth abuse, and multifactor authentication bypass.
Barracuda Research’s report is based on an international survey of 2,000 IT and security decision-makers. It also shows that security teams struggle to keep pace with expanding responsibilities. Half say their security professionals are expected to support growing digital operations without additional resources. Further, 40% say business expectations exceed the team’s cybersecurity skills and tooling, while 35% say expectations exceed staffing capacity. As a result, 67% say their teams struggle to scale to meet expanding, evolving business needs, and nearly a third (32%) say they can protect the business only reactively rather than proactively.
“The findings show how the impact of AI is changing the cybersecurity landscape faster than many security teams can build the necessary skills, visibility, and governance,” said Siroui Mushegian, Senior Vice President and Chief Information Officer, Barracuda. “Organizations need to reshape their security teams, combining the power of AI and automation with human expertise, judgement, and visibility. We must nurture these critical skills in the next generation of cybersecurity professionals, building new development pathways and opportunities for hands-on experience.”
AI is Changing Roles, But Not Removing the Need for People
Most organizations (79%) report that AI is already affecting security roles or head count. More than half (56%) have experienced professional workforce reductions linked to AI, divided evenly between entry-level and more senior positions.
At the same time, organizations continue to rely on human expertise for critical decisions. More than two-thirds (69%) use a shared decision-making model in incident response, where AI supports investigation and analysis while people retain responsibility for context, judgement, and final decisions.
Reshaping Cybersecurity Careers
As organizations implement consolidated security tools and AI takes on more routine analysis and response activities, human roles are shifting toward threat investigation, incident leadership, automation governance, and business risk management.
More than half (56%) the organizations surveyed say they need additional skills and expertise in incident response, decision making under pressure, and risk. These skill shortages could deepen if organizations automating the work of entry-level roles fail to build clear development pathways for new cybersecurity professionals.
The definition of a senior security professional is broadening as well. Technical expertise remains essential, but it increasingly needs to be combined with AI literacy, identity security knowledge, governance awareness, and strong communication skills as cybersecurity becomes a board-level business issue. Six in ten 61% reported skills needs in strategic security leadership, including AI governance and translating technical risk into business impact.