Preparing the Cybersecurity Workforce to Protect Critical National Infrastructure

Cybersecurity risks to critical national infrastructure (CNI) can quickly become tangible threats to everyday life. When power, water, transportation, health care or communications systems are disrupted, the consequences are measured in more than records lost or hours of downtime.

This concern was the central thread running through ISC2’s recent webinar on skilling the cybersecurity workforce to protect critical national infrastructure, especially as physical and digital systems converge. The discussion framed CNI as a practical challenge for the profession: the systems society depends on are becoming more connected, interdependent and exposed to cyber risk, and protecting them requires cybersecurity professionals who can think beyond any single tool, team or environment.

Technology is advancing faster than the governance, funding and workforce models built around it. AI, connected infrastructure and converged IT and operational technology environments are accelerating that change. The question is no longer whether cyber risk can affect physical operations. It already can. The harder question is whether organizations have the skills, judgment and operational context to keep services running when something goes wrong.

The Cyber-Physical Divide No Longer Holds

Critical infrastructure used to be easier to talk about in separate lanes: enterprise IT in one place, operational systems in another. That separation has eroded. Essential services now depend on connected business systems, vendors, data flows and operational technology that was originally designed for reliability and safety, not for today’s cyber threats and fast-accelerating AI risk.

For cybersecurity professionals, this transformation changes the stakes. A weakness that looks routine in an IT environment can become much more consequential when it creates a pathway into systems where availability and continuity matter as much as confidentiality and integrity.

Every practitioner does not need to become an industrial control systems engineer, of course; however, CNI protection does require cybersecurity fundamentals paired with operational awareness. Access control, monitoring, incident response, architecture, recovery planning and communication all still matter. What changes is the context and the consequences of getting the tradeoffs wrong.

Resilience Is the Real Goal

The webinar also made an important distinction between prevention and resilience. Prevention still matters. No organization can assume every intrusion, outage or disruption will be stopped at the edge. For critical infrastructure, the practical test is whether the service can continue, degrade safely or recover quickly. Resilience is the name of the game for critical infrastructure and the communities that depend on it.

That is why CNI cybersecurity cannot be treated as purely technical. It is tied to governance, funding, procurement, regulation, operations, public-private coordination and workforce planning. Water systems are a clear example: they support public health, hospitals, homes, industry and local economies. And now, more than ever, water systems are fundamental to data centers and AI systems that rely on power and cooling, making them compelling targets to bad actors.

A small utility may not need a large internal cybersecurity team, but it does need a realistic operating model: baseline cyber literacy, trusted support, escalation paths, monitoring, recovery planning and defined points of contact. The goal is to make each organization harder to disrupt, faster to recover and clearer about who acts when pressure rises.

Skills Needs Are Now the Workforce Challenge

The workforce discussion is shifting as well. The latest ISC2 Cybersecurity Workforce Study found that 59% of respondents reported critical or significant skills needs, up from 44% in 2024, and 95% reported at least one skills gap in their organization. The leading causes included difficulty finding people with the right skills and not having enough budget to hire.

For critical infrastructure, the answer cannot simply be “hire more people,” especially for smaller operators competing for scarce talent. A more workable approach is to increase capacity through shared expertise, regional support, cross-training, upskilling, certifications, exercises, apprenticeships and partnerships among government, industry and education.

Cybersecurity professionals also need pathways that build experience, not just credentials. Degrees, certifications, apprenticeships, military transitions and employer-led training each have a role. Together, they can create more ways for people to become job-ready before they are expected to operate independently in high-consequence environments.

AI Raises the Stakes for Human Judgment

AI adds another layer. It can help defenders sort signals, prioritize work and move faster. It does not remove the need for human judgment. If anything, it makes that judgment more important.

ISC2 research has found that among cybersecurity professionals using AI, 65% reported spending more time than the prior year deciding when to trust or act on AI-generated recommendations, while 63% spent more time reviewing or validating AI outputs. In critical infrastructure, that review is not a formality. A recommendation accepted too quickly could affect safety, continuity or public confidence.

That is why “human in the loop” has to mean more than rubber-stamping a machine answer. The person in that role needs authority, context and time to make a real decision. Cybersecurity professionals bring accountability, operational understanding and the ability to explain risk in ways others can act on.

A Mission Worth Addressing

Many people enter cybersecurity because they want their work to matter. Critical infrastructure makes that purpose concrete. Clean water, reliable power, safe transportation, functioning hospitals and resilient communications are the systems people depend on quietly, every day, until something goes wrong.

Protecting those systems will require policy, technology and investment. It will also require a workforce with the skills, support and pathways to do difficult work well. Cybersecurity professionals can help by sharing what they see in practice, contributing to workforce and policy discussions, and keeping resilience grounded in day-to-day operations.

To hear the full conversation, watch the "Skilling the Cybersecurity Workforce to Protect Critical National Infrastructure" webinar on demand.

Related Insights: