Cybersecurity job postings in the United States are down 26% since January. Read quickly, the number reassures every leadership team that has struggled to hire for five years: the market is loosening, candidates will come back. Read closely, it says the opposite. The roles disappearing are the ones you knew how to fill. The roles appearing demand skills almost nobody has yet, AI first. And in Canada, meanwhile, organizations have quietly decided: they employ less security staff and hand the work to providers.
Our position: the talent shortage didn't vanish, it changed shape, and you won't hire your way out of risk. A leadership team that waits for a full team before governing its security will wait a long time. One that decides which roles stay in-house, what it hands over and how it governs that can do it with the people it already has.
What the US postings say
From January 1 to September 30, the specialist staffing firm CyberSN counted 235,786 cybersecurity job postings in the United States, against 320,210 over the same period of 2025: down 26.4%, nine functions out of ten declining, and a median drop of 28.9% per role. Status: reported; these are postings, not vacancies or hires. Two readings follow.
First, this is not a collapse, it is a return. Against 2024 the decline is only 3.7%, and the three quarters of 2026 sit between 78,000 and 79,200 postings. The anomaly was 2025.
Second, the mix is changing more than the volume. Leadership and risk roles are shrinking: CISOs (down 38.9%), cyber risk analysts (down 51.5%), penetration testers (down 45.9%). Two roles are exploding: AI security engineer (up 268.3%) and cybersecurity data scientist (up 203.5%). Governance, risk and compliance rose from 9.4% to 14.8% of postings, but most of that gain comes from cybersecurity and privacy attorneys, whose share went from 4.1% to 10.3%. Entry-level roles: 9.5% of the total.
ISC2's global workforce study, published in December 2025 (16,029 professionals, 6% of them in Canada), tells the same story from inside the teams. 59% rate their skills gaps critical or significant, up from 44% a year earlier. AI is the most-missing skill (41%), ahead of cloud security (36%). At the same time, 39% of organizations have frozen hiring, 36% have cut budgets and 24% have laid people off. Notably, for the first time ISC2 published no estimate of the workforce gap. Its respondents are no longer short of heads; they are short of skills.
What it changes: the market will deliver neither a complete team nor the AI skills your projects already demand. It delivers rare, expensive specialists, fought over by organizations bigger than yours.
In Canada, the shortage moved to the providers
The last national estimate dates from 2022: roughly 25,000 unfilled positions, one in six, against some 124,000 professionals employed (Information and Communications Technology Council, from the ISC2 count). Nobody has published better since. The Canadian market follows the American one with a few quarters' lag: a specialist job platform counted 663 Canadian postings in the second quarter of 2026, the highest in seven quarters, of which 4.1% were junior roles and 68.2% mid-level. Status: reported, small sample.
The most telling number comes from Statistics Canada. In its survey of cyber security and cybercrime (12,462 businesses with ten or more employees, 2023 data), the share of organizations employing cybersecurity workers fell by 11%, "mainly due to the use of independent cybersecurity consultants and managed service providers". In the same survey, only 22% of businesses gave formal cybersecurity training to non-IT employees, and recovery costs after incidents doubled, to $1.2 billion.
In Quebec the picture is sharper still. The 2025-2028 sector diagnostic from TechnoCompétences, the province's ICT workforce committee, counts 8,800 cybersecurity specialists in Quebec in May 2024. Among the organizations it surveyed, one cybersecurity specialist position in five was vacant in 2024, and they expect 13% more positions by 2027. Their training needs, in order: AI and data science (71%), cybersecurity (63%), AI ethics (58%). Job Bank rates the occupation's outlook "good" for 2025 to 2027, very good in the Capitale-Nationale, Laurentides and Outaouais regions, with one detail that says it all: few unemployed workers have recent experience in the field. Meanwhile, 19.2% of Canadian businesses were already using AI to produce goods or deliver services in the second quarter of 2026.
What it changes: your security team is already, in part, a vendor. The question is no longer "who will we hire?" but "who, here, decides, and who governs the provider we handed the rest to?"
Three readings for a leadership team
You won't get the full team. Choose what stays in-house. Deciding on a risk, owning the provider relationship, commanding the response to an incident: three roles that cannot be delegated, because a provider executes but does not carry your risk. Everything else can be bought.
Your security provider is a critical vendor. It holds your access, your logs and often your keys. It deserves the same questions as any third party: its subcontractors, where your data sleeps, its notification deadline, your exit plan. And it belongs in your register, alongside the vendors you cannot lose.
The missing skills are AI and governance. They are processes before they are hires. You won't recruit an AI security engineer whose demand has tripled. You can, this week, write the one-page usage rule, inventory your AI uses and name who answers for them. That is what a specialist would do on arrival; don't wait for one.
The method: three roles, a governed provider, a short list
1. Name three people, not three departments. The risk owner, who accepts or refuses. The provider owner, who reads the reports, holds the relationship and checks. The incident coordinator, who decides at two in the morning. Part-time is normal. Nameless is a hole. The four owners of every risk gives the detail.
2. Write on one page what is handed over and what is required. Monitoring, incident response, testing, patch management: for each line, the provider, the notification deadline, the access it holds, the exit plan. Our vendor security questionnaire asks those questions; send it to your security provider first.
3. Give the people you have a short list. Five to ten actions, not 2,000 alerts. An analyst's hour must go to what reduces risk: exploited, exposed, targeted, in that order. A small team working the right list beats a large team sorting.
4. Train outside IT and open the door to beginners. Twenty-two percent of businesses train their non-IT staff; Canadian postings are 4% junior. Nobody will train your future seniors for you: an internship, a co-op placement, an entry-level hire with a mentor cost less than a six-month search. And fifteen minutes of AI training for everyone beats a ban.
This week's test
Thirty minutes, three questions, asked separately of IT and of leadership.
- Who accepted the last security risk, and where is it written?
- Who received the provider's last overnight alert, and who decided?
- If our security provider disappeared on Monday, what would we lose: access, logs, keys, knowledge?
If an answer is a vendor's name with no internal name beside it, the governance of your security is outsourced too. If the two lists differ, nobody holds it.
What you should have in a month
Three named roles; a one-page "handed over, required" statement the provider has signed; a list of at most ten actions, reviewed weekly; a training plan that starts outside IT; and a first number for the board: roles covered, and the time between an alert and a decision. It is the most honest talent indicator there is: it measures whether someone decides, not how many people are seated.
Where FortaRisks comes in
The platform is built for a small team: the visibility of a large enterprise, without its headcount. Forta Cockpit holds the register, the owners and the decisions, and gives leadership its one-page view. Forta Actions carries the short list, followed by your teams and your provider in the same tool. Forta Exposure sees what an attacker sees, with no agent to install and no team to mobilize. Forta Suppliers governs your security provider like any critical third party, questionnaire and real attack surface side by side. To start without installing anything: the free exposure report shows within 48 hours what answers on the internet at your company, and thirty minutes with an expert is enough to triage your risks and your pending requests.
Sources: Statistics Canada, Canadian Survey of Cyber Security and Cybercrime · Canadian Centre for Cyber Security, Ransomware Threat Outlook 2025-2027 (figures from the 2023 survey) · Statistics Canada, analysis of artificial intelligence use by businesses, second quarter of 2026 · Job Bank, outlook for cybersecurity specialists in Quebec, 2025-2027 · TechnoCompétences, 2025-2028 sector diagnostic of the ICT workforce in Quebec · ISC2, 2025 Cybersecurity Workforce Study · Information and Communications Technology Council, Cybersecurity Talent Development (2022)