The 2025 Global Cybersecurity Skills Gap Report from Fortinet underscores how workforce shortages and evolving threats continue to challenge organizations
- AI enhances protection but does not replace human expertise
- Over 4.7 Million Cybersecurity Vacancies Worldwide
Fortinet, the global cybersecurity leader driving the convergence of networking and security, today released its 2025 Global Cybersecurity Skills Gap Report, shedding light on the new and persistent challenges organizations face due to the cybersecurity skills gap. The global survey’s key findings include:
- As organizations are turning increasingly to AI to strengthen their security postures and fill gaps, they also acknowledge that AI may be used against them as an engine of new or improved cyberattacks, especially given the lack of AI skillsets across teams.
- Lack of cybersecurity awareness and training remains the top cause of breaches.
- Boards lack cyber knowledge, despite it being a priority.
- Organizations want cybersecurity personnel with certifications.
In Saudi Arabia, digital transformation under Vision 2030 has accelerated cloud adoption, e-government services, and smart city development, making AI-driven cybersecurity capabilities critical. The Kingdom’s National Cybersecurity Authority (NCA) emphasizes local talent development. However, demand still far outpaces supply.
“This year’s survey further underscores the urgent need to invest in cybersecurity talent,” said Carl Windsor, CISO at Fortinet. “Without closing the skills gap, organizations will continue to face rising breach rates and escalating costs. The findings highlight an inflection point for both public and private sectors: without bold action to build and retain cybersecurity expertise, the risks and costs will only continue to grow for our society.”
“As Saudi Arabia accelerates its digital transformation under Vision 2030, cybersecurity has become a foundational pillar for national resilience and economic growth. The Fortinet Skills Gap Report confirms the on the ground observation that while AI is essential to enhancing cyber defense, the Kingdom must prioritize upskilling the cybersecurity workforce to fully realise its benefits. Strategic initiatives, such as the Saudi Cybersecurity Workforce Development Program and increased access to industry recognised certifications, are vital to building local capabilities. Public-private partnerships will be key to equipping local talent with the AI expertise needed to protect critical infrastructure, government services, and the broader digital economy.” said Sami Alshwairakh, Senior Regional Director Sales at Fortinet.
Report Links Cyber Skills Gap to Escalating Security and Financial Risks
As cyberthreats continue to escalate, organizations face the reality that security attacks are not just a possibility but a certainty. At the same time, an estimated global shortfall of more than 4.7 million skilled professionals leads to critical security roles being unfilled at a time when they are needed most. Key findings about the impact of the skills gap on organizations globally include:
- The volume of breaches organizations experience is increasing year over year. According to the 2025 Fortinet Global Skills Gap Report, 86% of organizations experienced at least one cyber breach in 2024, with nearly one-third (28%) reporting five or more. These figures mark a significant increase from 2021, when the inaugural Fortinet Global Skills Gap Report was released, in which 80% of organizations reported breaches, and only 19% faced five or more.
- The cybersecurity skills shortage is a key contributor to increased breaches. More than 50% of those surveyed (54%) indicated a lack of IT security skills and training as one of the leading causes of breaches in their organizations.
- Financial ramifications of breaches remain significant. More than half (52%) of surveyed organizations say cyber incidents cost them over $1 million in 2024, consistent with the prior year’s findings and sharply up from 38% in 2021.
In the Kingdom, government and financial services sectors are high-value targets. Saudi organizations report a growing number of incidents, especially around identity fraud, phishing, and AI-driven attacks. Regulatory frameworks like the Essential Cybersecurity Controls (ECC) mandate stronger cyber resilience, but local talent development still struggles to keep pace.
AI Could Ease Strain on Security Teams, but Lack of Expertise Is a Growing Risk
While AI offers critical relief amid ongoing cyber skills shortages, organizations may not yet be fully prepared to harness its potential securely. This year’s survey found:
- Security technology with AI capabilities has been widely adopted. An overwhelming 97% of organizations surveyed are either already using or plan to implement AI-enabled cybersecurity solutions, with threat detection and prevention cited as the top areas of interest for applying AI in cybersecurity.
- AI can help alleviate the burden on short-staffed security teams. 87% of cybersecurity professionals expect AI to enhance their roles, rather than replace them, offering efficiency and relief amid skills shortages.
- While AI can help security teams, teams lack AI skillsets to unlock the technology’s full potential. A majority of those surveyed (80%) say AI is helping their IT and security teams become more effective, but nearly half (48%) of IT decision makers point to a lack of staff with sufficient AI expertise as the biggest challenge to successful implementation. Seventy-six percent of organizations that suffered nine or more cyberattacks in 2024 had AI tools in place, suggesting that adoption alone isn’t enough without the right expertise.
Saudi enterprises are early adopters of AI in cybersecurity, especially in government, oil & gas, and banking sectors. Yet, access to AI-specialized cybersecurity professionals remains limited, prompting initiatives like the Saudi Cybersecurity Workforce Development Program to address this gap.
As Board-Level Focus on Cybersecurity Grows, Understanding of AI Impact Lags
When it comes to the board of directors’ understanding of cybersecurity’s role at their organization, the report revealed the following:
- Cybersecurity prioritization at the board level is on the rise with 76% of boards increasing their focus on the issue in 2024. Nearly all organizations now view cybersecurity as both a business (96%) and financial (95%) priority.
- Board members aren’t as aware of the potential risks that AI use poses to their organizations. Fewer than half (49%) of all respondents indicated their boards fully understand the risks posed by AI, with awareness closely linked to whether their organizations are already deploying AI in their cybersecurity programs.
Upskilling Remains a Focus in Addressing the Skill Gap
As the cyber skills shortage persists, other key findings from the report include:
- Certifications continue to be highly valued by employers. Eighty-nine percent of IT decision-makers prefer to hire candidates who hold certifications. Most respondents said certifications validate cybersecurity knowledge (67%), demonstrate an ability to stay current in a fast-evolving field (61%), and indicate familiarity with key vendor tools (56%).
- Organizational support for funding certifications has declined. Only 73% of respondents now say they are willing to pay for employees to obtain certifications, down from 89% in 2023.
National initiatives like the Saudi Digital Academy and partnerships with global firms are working to close the cyber talent gap by subsidizing professional certifications and upskilling programs.
Closing the Skills Gap Is Critical to Business Resilience
The 2025 Cybersecurity Skills GapReport makes clear that cybersecurity has become a board-level priority, driven by the rise of AI and the escalating risks to business operations. Closing the global skills gap remains essential. Organizations must rethink hiring practices, tap into underutilized talent pools, and invest in training and upskilling to build and retain the expertise they need. This requires a coordinated approach grounded in three key pillars: raising awareness and education, expanding access to targeted training and certification, and embracing advanced security technologies.
To help organizations address the challenges they face as a result of the cyber skills gap, the award-winning Fortinet Training Institute, one of the industry’s broadest training and certification programs, is dedicated to making cybersecurity certification and new career opportunities available to all populations, including a Security Awareness Training service for organizations to develop a cyber-aware workforce. The Security Awareness and Training service offers AI-focused modules to enhance understanding of AI and the role it plays in cybersecurity, including an introduction to GenAI and curriculum around AI-powered threats, covering the various methods that cybercriminals use when harnessing AI to create and enhance cyberattacks.
Additionally, as part of Fortinet’s commitment to addressing this growing challenge, Fortinet is on track to train 1 million people in cybersecurity around the world by the end of 2026, since setting that pledge in 2021.
