A closer look at the findings from the most recent ISC2 Cybersecurity Workforce Study, from the perspective of respondents within the cybersecurity community in India.
The 2025 ISC2 Cybersecurity Workforce Study offers an important snapshot of how India's cybersecurity profession is evolving. Based on responses from 524 cybersecurity professionals in India as part of a global survey of more than 16,000 practitioners and decision-makers, the findings reveal a profession navigating economic uncertainty, accelerating artificial intelligence (AI) adoption and persistent skills shortages, while remaining optimistic about its future.
For cybersecurity leaders, hiring managers and practitioners, perhaps the most significant finding is that skills shortages have overtaken staffing shortages as the primary workforce concern. At the same time, AI is emerging as both the biggest skills requirement and one of the most significant opportunities to improve productivity and resilience.
Economic Conditions Improve Amid Lingering Pressures
There are encouraging signs that the difficult economic conditions affecting cybersecurity teams over the past several years may be beginning to ease in India.
Compared with 2024, respondents reported reductions in cybersecurity-related budget cuts, hiring freezes, layoffs and freezes on promotions and pay increases. Budget cuts fell from 51% to 39%, while hiring freezes declined from 54% to 44%.
However, this is far from a return to pre-pressure conditions. More than one-third of respondents still experienced cybersecurity layoffs, with many teams remaining constrained by limited budgets and cautious spending. Respondents continue to express concerns that financial pressures are weakening organizational resilience.
These concerns are reflected in attitudes toward cybersecurity staffing decisions. Nearly seven in 10 respondents believe organizations should be held accountable if they suffer a breach after reducing cybersecurity staff, while 60% agree that cybersecurity cutbacks significantly increase the likelihood of a breach.
At the same time, confidence has not disappeared. Almost two-thirds of respondents believe their organizations will have the resources necessary to address security incidents over the next 2-3 years.
Skills Gaps Have Become the Dominant Workforce Challenge
One of the most striking findings is the scale of cybersecurity skills shortages across India.
An overwhelming 97% of respondents reported at least one cybersecurity skills need within their organization, while 74% described those needs as critical or significant. Only 3% reported having no skills gaps at all.
This represents a shift in the cybersecurity workforce conversation. For years, discussions focused largely on headcount shortages. In 2025, the more pressing concern is whether teams possess the right expertise to address rapidly evolving technologies, threats and business requirements.
The most in-demand skill in India is AI, cited by 52% of respondents. Cloud security followed at 43%, with application security (38%), security analysis (34%) and risk management (32%) rounding out the top priorities.
The causes of these gaps are varied. Respondents report growing faster than their cybersecurity teams can support, difficulties retaining employees with highly sought-after expertise and challenges finding qualified candidates in the labor market. AI itself is contributing to uncertainty as organizations struggle to determine which skills will be most important in the future.
The consequences are significant. Skills shortages are slowing incident response, reducing organizations’ ability to deploy emerging technologies, limiting threat visibility and increasing reliance on underqualified personnel. Fully 85% of respondents reported at least one negative consequence from cybersecurity skills gaps, and two-thirds experienced multiple impacts.
Staffing Shortages Are Improving, But Not Solved
Despite worsening skills concerns, staffing levels themselves are showing modest improvement.
In 2024, 59% of respondents reported cybersecurity staff shortages. By 2025, that figure had fallen to 48%. Meanwhile, the proportion reporting the "right amount" of cybersecurity staff increased from 38% to 44%.
These improvements suggest that organizations may be stabilizing hiring after the disruptions of recent years. However, staffing improvements have not translated directly into capability improvements. The findings show that simply having people in seats is no longer enough. Organizations need personnel with skills aligned to emerging priorities, especially AI, cloud security and modern risk management practices.
AI Is Reshaping Cybersecurity Faster Than Any Other Technology
AI is now at the center of workforce planning across India's cybersecurity sector.
More than one-third of respondents stated their organizations have already integrated AI security tools into operations, while another 22% said their organizations are actively testing them. Overall, 77% of respondents said their organizations are either using, testing or evaluating AI security technologies.
Importantly, practitioners largely view AI as an opportunity rather than a threat. The study consistently found optimism about AI's impact on careers, with professionals viewing it as an enhancement to human capability rather than a replacement for cybersecurity jobs.
The productivity gains appear substantial. Some 85% of respondents with cybersecurity teams that have adopted AI tools reported significant productivity improvements.
Respondents expect AI to deliver the greatest near-term value in security operations, network monitoring, security testing and vulnerability management. These areas depend heavily on analyzing large volumes of data and repetitive processes, making them ideal candidates for automation and augmentation.
However, AI has also changed the threat landscape, as 41% of respondents reported experiencing AI-driven social engineering attacks during the past year. Others reported AI-related data leakage (31%), deepfakes (30%), data breaches (29%) and suspected AI-powered cyberattacks (26%).
These findings suggest that organizations must simultaneously invest in AI-enabled defense capabilities while preparing for increasingly sophisticated AI-enabled attacks.
A Disconnect Exists Between Employers and Professionals
One of the more revealing sections of the study highlights a mismatch between what cybersecurity professionals believe is important and what hiring managers prioritize.
Both groups broadly agreed that AI and cloud security are highly valuable. However, notable gaps emerged in other areas. Professionals placed significantly greater value on governance, risk and compliance (GRC), while hiring managers ranked technical domains such as security analysis and security engineering more highly.
A similar pattern appeared with non-technical skills. Hiring managers identified problem-solving, teamwork and communication as the most important capabilities. Professionals generally agreed but placed greater emphasis on leadership, strategic thinking and GRC-related competencies.
This disconnect has implications for recruitment, workforce development and retention. Organizations that fail to align career pathways with what professionals viewed as valuable may struggle to attract and retain talent.
Job Satisfaction Remains Strong, But Warning Signs Are Emerging
Despite economic disruption, skills shortages and AI-driven change, cybersecurity professionals in India remain largely satisfied with their careers.
Overall job satisfaction increased from 66% in 2024 to 71% in 2025. Team relationships remained the strongest contributor to positive workplace experiences, followed by organizational culture and day-to-day work.
Passion for the profession remains particularly strong, with 82% of respondents having reported feeling passionate about cybersecurity work and 82% also stated an intention to remain in the profession for the remainder of their careers.
However, retention risks should not be ignored. While 73% expected to remain with their current employer over the next year, only 60% expected to remain over the next two years.
Career growth opportunities emerged as the leading engagement driver and the leading cause of dissatisfaction when absent. Training, professional development and learning opportunities consistently appear among the factors professionals value most.
Burnout also remains a concern. More than half of respondents feel overwhelmed by their workloads, while 44% reported exhaustion from the constant effort required to stay current on threats and emerging technologies.
What Cybersecurity Leaders in India Should Do Next
The findings point to several practical actions for both cybersecurity professionals and hiring managers.
For Hiring Managers and Security Leaders
- Prioritize skills development over headcount growth. The biggest challenge is capability, not simply staffing. Invest in structured learning programs, certifications and internal mobility.
- Build AI readiness immediately. AI is now the most in-demand cybersecurity skill and a major source of productivity gains. Organizations that delay adoption risk falling behind.
- Create visible career pathways. Career advancement is both the strongest engagement driver and the leading contributor to dissatisfaction when absent.
- Address burnout proactively. Reduce workload pressures where possible, automate repetitive tasks and give employees time for professional development.
- Strengthen leadership engagement. Cybersecurity professionals want to see cybersecurity recognized as a strategic business function rather than simply an operational requirement.
For Cybersecurity Professionals
- Focus on the right specialisms. Prioritize AI and cloud security skills development.
- Look beyond the technical. Continue developing both technical and business-oriented competencies such as risk management and governance.
- Step up. Seek opportunities for cross-training and leadership experience.
- Flexible first. Focus on adaptability, as emerging technologies will continue reshaping job roles and responsibilities.
Conclusion
The study paints a nuanced picture of India's cybersecurity profession. Economic pressures are beginning to ease and staffing levels are improving, yet skills shortages have emerged as the defining workforce challenge. At the same time, AI is transforming both security operations and the threat landscape, creating urgent new requirements for skills development.
The encouraging news is that cybersecurity professionals remain passionate about their work and optimistic about the future. For organizations, the lesson is clear: success will depend less on hiring more people and more on being strategic and tactical, building the capabilities of the workforce already in place. Those that invest in skills, embrace AI responsibly, create career growth opportunities and support employee wellbeing will be best positioned to strengthen cyber resilience and compete for talent in the years ahead.
