Cybersecurity has one of the most contested headline statistics of any field covered in this series: the widely repeated "4.8 million unfilled cybersecurity jobs" figure. This article looks at what that number actually measures, where real demand concentrates, and why the entry-level picture doesn't match the shortage narrative you'll see in most marketing content.
The 4.8 million figure, and why it's contested
The 4.8 million figure, commonly attributed to ISC2, measures perceived workforce need as estimated through surveys, not actual, currently open job postings, and it was reportedly dropped from ISC2's own 2025 study. By contrast, CyberSeek, a more direct job-posting-based tracker, reports a considerably smaller figure: around 514,359 actual US cybersecurity job postings. That's still a large number, but it's roughly a tenth of the oft-cited 4.8 million figure, and the two numbers are measuring fundamentally different things.
It's worth being direct about the incentives here too: in October 2024, a CISO reportedly wrote an open letter to ISC2's board accusing it of knowingly promoting a false narrative of a plentiful-jobs market, and several of the sources promoting large shortage figures are staffing and recruiting firms with a direct commercial interest in a shortage narrative. None of this means there's no demand, but it means the headline numbers deserve real skepticism.
Where the real demand sits
A more defensible picture emerges once you separate by experience level:
- One analysis describes a 24% talent gap specifically for experienced cybersecurity roles
- The same analysis describes a surplus at the entry level, with a significant share of organizations reportedly making zero entry-level cybersecurity hires in a given period
This is a meaningfully different story than "millions of open jobs waiting for anyone with a certification." It's closer to: strong, real demand for experienced, specialized security professionals, and a genuinely crowded, competitive entry-level market, similar to the pattern seen in data science.
On the demand-signal side, Indeed Hiring Lab data (cited as of March 2026) reportedly shows cybersecurity job postings sitting at 113% of their pre-pandemic baseline, suggesting the field hasn't contracted even if the "millions of unfilled jobs" framing is overstated.
What this means if you're choosing cybersecurity as a major
The field has real, defensible demand, but succeeding in it as a new graduate requires the same strategy as data science or computer science: build specific, demonstrable skills (a home lab, capture-the-flag competition experience, specific certifications tied to real skills rather than collected for their own sake) rather than assuming the degree or a single certification opens doors on its own, given the reported entry-level surplus.
Country considerations
Cybersecurity demand is a global phenomenon, but the specific data cited here (ISC2, CyberSeek, Indeed Hiring Lab) is predominantly US-focused. If you're evaluating this field for a different destination country, check that country's own cybersecurity workforce data (for example, the UK's Cyber Security Skills in the UK Labour Market report) rather than assuming US figures transfer directly.
Bottom line
Cybersecurity has genuine, real demand, concentrated in experienced and specialized roles, but the entry-level market is more competitive than the famous "millions of unfilled jobs" headline suggests, and that headline figure itself is contested even within the industry. Treat cybersecurity as a field with a real future, but go in planning to build demonstrable, specific skills early rather than assuming broad shortage narratives apply to a first job search.
FAQ
Are there really millions of unfilled cybersecurity jobs? The widely cited 4.8 million figure measures perceived need, not actual open postings, and was reportedly dropped from ISC2's own more recent study. A job-posting-based tracker (CyberSeek) reports a considerably smaller, though still substantial, figure of around 514,000 US postings.
Is cybersecurity easy to break into as a new graduate? Not especially. Reports describe a surplus at the entry level even as experienced roles face a real talent gap, similar to the pattern in data science.
Which cybersecurity roles are actually in short supply? Experienced, specialized roles, reportedly facing around a 24% talent gap, rather than generalist entry-level positions.
Where can I check current, authoritative cybersecurity job data myself? CyberSeek's job-posting tracker and the BLS Occupational Outlook Handbook entry for information security analysts are more directly data-based than most shortage-narrative marketing content.