Report finds cybersecurity hiring shuts out junior talent

A SkillBit report on the shift to continuous cybersecurity micro-training has found that 70% of organisations have no junior roles, or very few, that they can fill with candidates holding less than two years of experience. Experience requirements are limiting the pool of junior candidates, and 57% of executives said new hires take an average of six months to reach full proficiency, with general IT knowledge and cybersecurity processes the most cited causes of delay.

More than 80% of executives surveyed used their full 2025 training budgets. Seventy-one percent of security leaders said they would prefer 20-minute online or interactive sessions each week over training that requires 30 to 40 hours once or twice a year, and urgent daily tasks were a leading reason employees miss development goals.

Thirty-nine percent of respondents reported skills decay on their teams, rising to 60% at companies with at least 50,000 employees. About two-thirds favoured problem-solving skills that apply across technology stacks over expertise in a specific set of tools, and leaders also valued curiosity, proactive learning and forensic skills.