Summary
- The UK cyber workforce was estimated at 145,900 people as of December 2025, up 2% year on year.
- Recruitment expectations among cyber companies have moderated, despite continued demand for specialist talent.
- Researchers estimate around 10,200 people will be needed during 2026 to meet growth and replace workers leaving the profession.
Growth in the UK cybersecurity workforce slowed markedly during 2025, with new government-backed research estimating that the profession expanded by just 2% to around 145,900 people across the economy.
The Department for Science, Innovation and Technology’s 2026 labour-market study places the 145,900 estimate at December 2025, an increase of approximately 2,900 people from the previous year. That compares with 5% growth between 2023 and 2024 and sits alongside wider evidence of a more difficult recruitment environment.
The research estimates that around 10,200 people will be required during 2026. Of those, approximately 4,400 would be needed to satisfy assumed growth in demand, while another 5,800 would replace people expected to leave the workforce through retirement or career changes.
The figure is a supply requirement rather than a conventional “skills gap”. Researchers deliberately removed the workforce-gap estimate used in earlier editions because weaker hiring demand and limitations in the available data made a single deficit number increasingly difficult to defend.
Recruitment expectations have also moderated. The study found that 53% of cyber companies expect to grow their workforce during 2026, down from 67% in the previous year’s research. Almost half now expect employee numbers to remain unchanged. At the same time, advertised core cyber roles increased compared with 2024, showing that slower aggregate workforce growth does not mean specialist demand has disappeared.
The distinction is important for a market that has spent years discussing cyber primarily as a shortage occupation. A constrained hiring environment can coexist with persistent difficulty filling specific roles, particularly where employers need experienced practitioners in areas such as cloud security, identity, incident response, secure engineering, operational technology, or governance.
The wider workforce estimate also extends beyond employees of cybersecurity vendors. It includes people working in cyber roles across financial services, government, retail, professional services, technology, infrastructure, and other parts of the economy, as well as self-employed professionals. DSIT separately estimates that businesses selling cybersecurity products and services employed 69,589 people during 2025.
That breadth makes the health of the labour market relevant to organisational resilience as well as the commercial cyber sector. Security capability is distributed through internal teams, technology functions, consultancies, service providers, regulators, and specialist suppliers. Slower hiring in one part of the market can therefore affect mobility and entry routes elsewhere.
The study also points to pressure at the beginning of the career pipeline. Graduate and training supply has expanded in recent years, while weaker vacancy demand can make it harder for early-career candidates to obtain the experience employers later require for more senior positions. That risks creating a mismatch in which organisations continue to report difficulty finding experienced practitioners while newcomers struggle to secure their first role.
The 2026 report does not describe a cyber labour market that has stopped growing. It describes one that has become more selective. The workforce is larger than a year ago, employers still expect net demand, and thousands of replacement hires will be required — but the era in which headline workforce shortages alone explained the employment market is becoming harder to sustain.
