UK cyber security workforce and skills figures: estimated employment, organisational skills gaps, advertised pay, routes into the profession and staff training. The data periods and populations are stated alongside the figures.
The UK has an unusually rich official evidence base on cyber skills, but it is scattered across half a dozen releases. The Department for Science, Innovation and Technology (DSIT) publishes an annual Cyber security skills in the UK labour market report — the core series — plus a spring Cyber Security Sectoral Analysis, and the government's Cyber Security Breaches Survey measures how many organisations train their staff and put cyber on the board agenda. Industry fills in the rest: the ISC2 Cybersecurity Workforce Study has a dedicated UK cut, CIISec surveys the profession itself, and the National Audit Office (NAO) and National Cyber Security Centre (NCSC) cover government's own workforce and the education pipeline.
This page stitches those series together into one referenced set of workforce, shortage and training numbers. It is scoped to skills and workforce data only — every figure carries its data period, and every source is linked in full at the end.
Key facts and figures
- 145,900 people were estimated to work in UK cyber security roles in December 2025, an experimental estimate up 2% on the previous year.
- 8,600 people were estimated to enter the UK cyber workforce through formal education and training pathways in 2025.
- 57% of UK businesses had a basic technical cyber skills gap and 27% an advanced gap in DSIT’s August–October 2025 fieldwork.
- £58,050 was the median advertised salary for a core cyber role in 2025, among postings that disclosed pay.
- 16% of the cyber security sector workforce was estimated to be female in the 2026 labour market study, compared with 48% of the whole UK workforce.
- 19% of UK businesses ran any cyber security training or awareness activity in the year before the 2025/26 survey.
- 69,589 full-time equivalents were employed in the UK cyber security sector in the 2026 analysis — up 3%, the slowest growth since 2018.
- 1 in 3 central-government cyber security roles was vacant or filled by temporary staff in 2023-24.
The headline measures at a glance:
| Measure | Latest figure | Data period | Trend / detail |
|---|---|---|---|
| UK cyber security workforce | ~145,900 people | December 2025 estimate; September 2026 report | Experimental estimate, up 2% |
| Entrants through formal education and training | ~8,600 people | 2025 estimate | Not an estimate of the workforce shortfall |
| Businesses with a basic skills gap | 57% | Fieldwork August–October 2025 | 27% had an advanced technical skills gap |
| Median core cyber salary (advertised) | £58,050 | 2025 job postings disclosing salary | 76% of core cyber postings did not disclose pay |
| Core cyber job postings | 2,911 per month | 2025 average | 34,932 core postings; reported increase of 7% |
| Cyber sector employment | 69,589 FTEs | 2025 employment; 2026 analysis | Up 3% (~2,300 jobs) — slowest growth since 2018 |
| Businesses running cyber training | 19% | 2025/26 survey (published Apr 2026) | 84% of large firms vs 14% of micro firms |
Checked on 15 October 2026. The latest labour-market report was published on 29 September 2026, using 2025 surveys and job-posting data alongside education data for earlier academic years. The workforce-shortfall estimate used in previous editions has been withdrawn from the latest report because of data and modelling limitations.
How many people work in cyber security in the UK?
DSIT’s 2026 labour-market report estimates approximately 145,900 people in cyber security roles across the UK economy in December 2025, up 2% from 143,000. This is an experimental model-based estimate, rather than an employment census. Growth was slower than the 5% increase reported for the previous year.
The 2026 Sectoral Analysis estimates 69,589 full-time equivalents in cyber-related roles across 2,603 businesses selling cyber products and services in 2025. That is up 3%, or 2,290 FTEs, from 67,299. The same study estimates £14.7 billion in revenue and £9.1 billion in gross value added; diversified suppliers as well as specialist cyber firms are included.
These employment measures differ in unit and coverage. The 145,900 estimate concerns people in cyber roles throughout the economy; the 69,589 measure concerns full-time-equivalent cyber employment among identified suppliers. They are not two interchangeable estimates or figures that should be added together.
How big is the UK cyber security skills shortage?
The 2026 labour-market report no longer publishes a single workforce-shortfall estimate, citing data limitations, necessary assumptions and reduced recruitment demand. Its separate supply and demand scenarios should not be subtracted to recreate a headline shortage. Organisational skill gaps remain measurable even without a national vacancy-gap total.
In fieldwork from August to October 2025, 57% of businesses had a basic technical skills gap, up from 49% in the previous study; 27% had an advanced gap. These measures reflect confidence in specified tasks and whether functions are outsourced. They are not counts of vacant jobs or formal tests of every employee’s competence.
ISC 2’s 2025 study offers a different perspective: among its UK respondents, 95% reported a skills gap in their organisation, 58% described shortages as critical or significant and 87% reported a negative consequence. These are practitioner responses, not a representative estimate of all UK businesses. CIISec’s 2025 survey summary separately reports that 75% of participating professionals identified people as their largest challenge, versus processes at 15% and technology at 10%.
Are UK cyber security jobs growing — and what do they pay?
Among 2025 core cyber job advertisements disclosing salary, the median was £58,050, up from £55,000 in 2024. DSIT estimates an 11% premium against its broader IT salary comparator. However, 76% of core cyber postings contained no salary information, and advertised salaries are not a survey of actual pay received by every worker.
The report identifies 34,932 core cyber job postings in 2025, averaging 2,911 per month, and reports a 7% increase over the prior year. It also identifies 32,032 other cyber-enabled postings. Advertisements measure recruitment activity rather than completed hires, and their movement need not match growth in the employed workforce.
Where is new cyber talent coming from?
DSIT estimates around 8,600 entrants through formal education and training pathways in 2025. The education pipeline includes 7,950 cyber security graduates in the 2023/24 academic year, up 14%, but graduates are not automatically new UK cyber workers. Outcomes, time lags and the range of roles entered affect the workforce estimate.
The pre-university pipeline runs through the NCSC's CyberFirst programme. CyberFirst has reached more than 350,000 students across the UK in its first ten years, and 14,500 girls entered the 2025 CyberFirst Girls Competition (NCSC Annual Review 2025, published October 2025). In June 2025 the government announced £187 million for TechFirst, the successor programme intended to broaden that schools pipeline into wider digital and AI skills.
The report estimates about 500 apprenticeship entrants into the UK cyber labour market, drawing on completion data from England and rounding for wider UK coverage. This is not a count of apprenticeship starts. A separate conversion and upskilling estimate was reduced to 1,500 because of limited new data, illustrating the uncertainty in pipeline modelling.
How diverse is the UK cyber workforce?
The 2026 study estimates that women accounted for 16% of the cyber security sector workforce, compared with 29% of the wider digital workforce and 48% of the whole UK workforce. The cyber figure comes from employers in the supplier sector and should not be labelled as a measurement of every cyber professional across the economy.
The same employer survey estimates ethnic minority representation at 19% overall and 9% in senior cyber sector roles. Reported neurodivergence was 22%, up from 9% in the 2020 study. Greater awareness and reporting may contribute to that change, so it does not necessarily represent an equivalent change in underlying prevalence.
| Group | Share of cyber sector workforce / programme count | Comparator / trend |
|---|---|---|
| Women | 16% | 29% of digital workforce; 48% of UK workforce |
| Ethnic minority backgrounds | 19% | 9% of senior cyber sector roles |
| Neurodivergent staff (reported) | 22% | 9% in 2020 study; reporting and awareness can change |
| Female entrants, CyberFirst Girls Competition | 14,500 entrants in 2025 | Part of 350,000+ students reached in ten years |
Diversity figures are employer estimates in DSIT’s 2026 labour-market report, using 2025 fieldwork. The CyberFirst row is a separate programme participation count from the NCSC Annual Review 2025; it does not measure workforce representation.
How many UK businesses actually train their staff?
Only 19% of UK businesses ran any cyber security training or awareness-raising activity in the 12 months before the 2025/26 Cyber Security Breaches Survey (published April 2026, fieldwork August–December 2025). The gap by size is enormous: 84% of large businesses trained staff, against just 14% of micro businesses. Among charities, training activity fell to 17% from 21% the year before.
The same survey found that 31% of businesses had a board member responsible for cyber security, up from 27%. Training activity and board responsibility are separate measures. An organisation reporting no recent awareness activity has not necessarily never trained staff, and the survey does not establish that any specific breach resulted from missing training.
Workforce, training and incident statistics answer different questions. The related breach and phishing guides explain attack patterns and reporting measures, while the human-error guide distinguishes non-cyber reports from incidents actually attributable to mistakes.
Is AI changing the skills the industry needs?
In the 2026 labour-market report, 70% of cyber sector businesses said staff used AI in day-to-day work, up from 53%; 73% expected their AI skills needs to increase in the next 12 months. These findings concern cyber suppliers surveyed in 2025, not all UK employers or all individual workers.
ISC 2’s separate UK analysis found that 42% of respondents who identified at least one skills need cited AI as an urgent capability gap. The denominator is that respondent group, not every UK organisation. Changing tools can create new training needs without establishing that every employer needs the same skills.
How big is the skills gap in government itself?
The state struggles to staff the roles it says the country depends on. One in three central-government cyber security roles was vacant or filled by temporary contingent labour in 2023-24, the National Audit Office found in its Government cyber resilience report (published January 2025). At the most specialist end the reliance on temps is extreme: 70% of the specialist security architects in post were temporary staff.
The NAO findings are a dated picture of government staffing and resilience, not a current vacancy count. Salary comparisons alone cannot explain vacancies: recruitment processes, career pathways, specialist requirements and workforce planning also matter. The £58,050 advertised-pay median is for 2025 core cyber postings that disclosed salaries, not a civil service pay benchmark.
Frequently asked questions
How many people work in cyber security in the UK?
DSIT’s experimental estimate is approximately 145,900 people in cyber roles across the UK economy in December 2025. Separately, its supplier-sector analysis estimates 69,589 full-time equivalents in cyber-related roles across 2,603 firms in 2025. The units and coverage differ.
How big is the UK cyber security skills shortage?
The latest report withdraws the previous national workforce-shortfall estimate because of data and modelling limitations. In its 2025 fieldwork, 57% of UK businesses had a basic technical skills gap and 27% an advanced gap. These are organisational skills measures, not numbers of vacancies.
What percentage of the UK cyber workforce is female?
The 2026 labour-market study estimates 16% in the cyber security supplier sector, compared with 29% of the wider digital workforce and 48% of the whole UK workforce. The cyber figure is an employer estimate for that sector, not all cyber professionals throughout the economy.
What is the median cyber security salary in the UK?
The median advertised salary for core cyber roles was £58,050 in 2025 among postings disclosing salary. Around 76% did not disclose pay. This is an advertised-pay measure, not the median earnings of all people already working in cyber security.
Are UK cyber security jobs growing or shrinking?
The experimental workforce estimate rose 2% to 145,900 people in December 2025. The latest report records 34,932 core cyber job postings during 2025, averaging 2,911 monthly, and reports a 7% annual increase. Postings and employed headcount measure different things.
How many UK businesses train their staff in cyber security?
Only 19% of businesses ran cyber security training or awareness activities in the year before the 2025/26 Cyber Security Breaches Survey — 84% of large firms but just 14% of micro firms. Charities fell to 17%.
Related guides
- Phishing Statistics UK: Attack Volumes & Trends
- Data Breach Statistics UK: ICO Reports, Trends & Costs
- Human Error Data Breach Statistics: What the ICO Data Shows
- AI and Data Privacy Statistics UK
- GDPR data breach: what to do in the first 72 hours
- What is GDPR? A UK guide to the General Data Protection Regulation
Sources & references
- DSIT — Cyber security skills in the UK labour market 2026, published 29 September
- DSIT — Cyber Security Sectoral Analysis 2026, employment in 2025
- DSIT and Home Office — Cyber Security Breaches Survey 2025/26
- ISC 2 — UK analysis of 2025 workforce-study respondents, May 2026
- National Audit Office — Government cyber resilience, January 2025
- NCSC — Annual Review 2025, CyberFirst
- CIISec — 2025 profession survey summary
Half of UK businesses lack basic cyber and data-handling skills — close your own gap with CPD-accredited training your whole team can finish in about 90 minutes.
Explore the GDPR & Data Protection Course →
Mark writes about data protection, workplace compliance and accredited online training for GDPR & Data Protection Course, part of Online CPD Academy.