AI is reshaping cybersecurity jobs, but the evidence stops short of a hiring frenzy

Two sharply different forecasts now frame the debate over artificial intelligence and cybersecurity work. In a September 2026 report from Business Insider, Cloudflare chief security officer Grant Bourzikas described competition for engineers with deep security and AI expertise as exceptionally intense. In the same report, former FBI official and Google director M.K. Palmore argued that automation could eventually reduce headcount while increasing the value of judgement and practical experience.

Neither assessment, on its own, establishes where the labour market is heading. Together, however, they capture the central tension: AI is creating systems that need to be secured and tools that can perform parts of security work. That can increase demand for particular capabilities without producing an equivalent increase in every category of job.

The available evidence supports a meaningful shift towards combined AI and cybersecurity expertise. It does not show that the entire market has reached the intensity of Bourzikas’s characterisation. The more defensible conclusion is that employers are reconsidering what security professionals need to know, which tasks should be automated and where human responsibility remains essential.

Strong growth does not prove an AI jobs boom

The broad US outlook is positive. The US Bureau of Labor Statistics reports that information security analysts held about 192,900 jobs in 2025 and projects employment in that occupation to grow by 21 per cent from 2025 to 2035, with about 14,100 openings each year. It identifies increased use of AI as one contributor to demand because organisations need to secure new technologies.

Those figures require careful interpretation. Information security analyst is one important occupation, not the whole cybersecurity workforce, and the projection does not count jobs dedicated to AI security. AI is also not presented as the sole cause of growth. The data therefore supports a strong occupational outlook, but not the claim that AI expertise alone is driving a broad hiring surge.

CyberSeek offers a narrower measure. Its homepage displays 514,359 US cybersecurity job listings for the reporting period from May 2024 to April 2025, but says only 10 per cent specifically referenced AI skills. That is a substantial number of advertisements, yet it falls well short of showing that AI has become a universal requirement.

There are limitations to that comparison. Job advertisements may omit capabilities that employers expect to teach, assume candidates already possess or describe using product-specific language. CyberSeek’s reporting period also ended more than a year before the Business Insider article. Even so, the 10 per cent figure is an important counterweight to sweeping descriptions of the market.

A shortage of skills is not simply a shortage of people

The 2025 ISC2 Cybersecurity Workforce Study points more clearly towards a capability gap. The study covered 16,029 practitioners and decision-makers across several regions, including Asia-Pacific. ISC2 did not publish its previous single estimate of the workforce gap, saying respondents were placing greater emphasis on the skills their teams lacked.

In that study, 59 per cent of respondents reported critical or significant skills needs, while 95 per cent identified at least one need. AI was the most frequently cited area at 41 per cent, followed by cloud security at 36 per cent. Among hiring managers, however, cloud security led technical priorities at 29 per cent, ahead of AI at 27 per cent and security engineering at 24 per cent.

The distinction matters. Employers can struggle to find particular combinations of experience even when many people are seeking work. A company looking for someone who can assess an AI system, understand its cloud integration and communicate risk to decision-makers is expressing a more specific need than a general shortage of cybersecurity workers.

ISC2’s nontechnical findings reinforce that point. Problem-solving, collaboration and communication led the priorities reported by hiring managers. The World Economic Forum separately identified AI and big data, networks and cybersecurity, and technological literacy as the three fastest-growing skill areas expected through 2030. Taken together, the research indicates that technical specialisation is growing alongside, rather than replacing, the demand for judgement and communication.

Using AI and securing AI are different kinds of work

Part of the confusion comes from treating AI skills as one category. NIST’s NICE workforce programme provides a more useful distinction: security through AI and security of AI. The first involves using AI-enabled tools to perform cybersecurity work. The second concerns protecting AI models, associated data and the systems into which AI is integrated.

NIST said in June 2025 that it was incorporating both forms of work through an AI Security Competency Area and updates to relevant roles. It released NICE Framework Components version 2.2.0 in April 2026, while current workforce guidance lists Artificial Intelligence Security among 11 competency areas. The framework describes capabilities rather than hiring outcomes, but it shows how an established workforce programme is formalising the change.

ISC2’s findings illustrate what those capabilities can involve. Respondents most often identified AI-assisted threat detection and response, at 42 per cent, followed by AI threat modelling and risk assessment at 39 per cent. Defence of AI models reached 35 per cent, secure cloud and edge AI integrations 31 per cent, and AI governance, data integrity or privacy 30 per cent.

These activities do not fit neatly into a single new occupation. A security team may use AI to identify and prioritise suspicious activity while also assessing the risks created by an AI model, its data and its connections to other services. Individual roles can cross both categories, and employers may describe the same work in inconsistent terms.

The entry-level contradiction

AI adoption is already moving beyond general interest in the ISC2 survey. Twenty-eight per cent of respondents said they had integrated AI security tools, 19 per cent were testing them and 22 per cent were evaluating them. That placed 69 per cent somewhere on the path towards regular use, although the figures measure reported adoption activity rather than its effect on employment.

Most respondents expected the transition to increase the importance of specialisation and strategy. Seventy-three per cent anticipated a need for more specialised cybersecurity skills, while 72 per cent expected more strategic mindsets. At the same time, Palmore’s assessment to Business Insider raised a harder possibility: alert-heavy junior work could be automated, leaving fewer roles and higher expectations for those who remain.

There is not yet longitudinal evidence in the research packet showing that entry-level cybersecurity jobs are disappearing. The concern is a forecast, not a measured outcome. It nevertheless exposes a plausible workforce contradiction already visible in the wider data. An occupation can grow over a decade while some routine tasks contract, job descriptions become more demanding and employers concentrate hiring on specialised experience.

That matters because repetitive analysis can also provide an environment in which less experienced workers learn how systems behave and how decisions are made. The available evidence does not establish what will replace that pathway if more triage is automated. It does show why a headline about rising demand cannot, by itself, answer whether entering the field will become easier.

No single qualification resolves the skills shift

For practitioners and new entrants, the research supports a layered approach rather than a race towards generic AI branding. Core cybersecurity competence remains the base. Cloud security and security engineering continue to rank prominently in hiring priorities, while the emerging layer includes AI-assisted detection, AI risk assessment, model defence, secure integrations, governance, privacy and data integrity.

Human capabilities complete that combination. Communication, collaboration, problem-solving and accountable judgement remain important because AI-enabled findings still need to be assessed, explained and connected to organisational decisions. Business Insider also reported Box chief executive Aaron Levie’s view that people would retain oversight and responsibility for the highest-stakes choices.

Interest in formal learning is high. ISC2 found that 48 per cent of respondents were building general AI skills, 17 per cent had obtained AI-focused qualifications and 53 per cent planned to obtain them. The study does not establish which courses or certifications improve hiring outcomes, so those figures should not be read as evidence that one credential offers a reliable shortcut into employment.

Australian readers should also treat the market numbers with caution. The ISC2 study included Asia-Pacific participants, and NIST’s distinction between using AI and securing it has international relevance. But the vacancy count and occupational projection cited here are US figures. Without current Australian vacancy and salary evidence, they cannot establish equivalent local demand or conditions.

The competing forecasts may ultimately describe different parts of the same transition. Cybersecurity can become more important as organisations adopt AI, even as automation reduces some tasks and employers seek fewer people with broader or deeper capabilities. The decisive question is therefore not whether every security job becomes an AI job. It is whether workers and employers can build the combination of security foundations, AI-specific competence and human judgement that the changing work requires.

The distinction between using AI for security work and securing AI systems makes foundational knowledge a useful anchor as roles evolve. That groundwork can be studied through The Hack Academy’s online cybersecurity training programme: its self-paced format combines practical exercises with theory, and listed subjects include cybersecurity fundamentals, networking and cloud security.