For many security leaders, AI is becoming an indispensable ally. Four out of five respondents (80 percent) said AI tools help their IT and security teams work more effectively, improving their ability to detect anomalies and respond to incidents faster.
Yet, there’s an uneasy awareness that the same technology can be turned against them. Nearly half (49 percent) of respondents expressed concern that cybercriminals using AI will escalate the frequency and complexity of attacks.
That tension — between empowerment and vulnerability — defines the current era of digital defense. As AI models become capable of generating realistic phishing messages, mimicking internal communications, or automating attacks, defenders are left to fight fire with fire.
The Talent Crunch Deepens
The cybersecurity workforce shortage is now widely viewed as a business risk rather than a technical inconvenience. Thomas Vick, a technology hiring expert at Robert Half, noted that without enough qualified personnel, teams can’t keep up with patch management, vulnerability mitigation, or incident response.
“As cyber risks escalate, attracting and retaining skilled cybersecurity professionals remains a business priority,” Vick said. “To stay competitive, many employers are offering higher salaries and attractive perks for top talent.”
Robert Half’s 2026 Salary Guide backs that up, showing that over 50 percent of U.S. employers are willing to raise starting pay for cybersecurity candidates, while 41 percent said they’d offer more for professionals with cloud security expertise.
Still, financial incentives can only go so far. Mark St. John, COO and co-founder of Neon Cyber, emphasized the long-term damage caused by high turnover. “Job hopping is easy for skilled professionals,” he said. “When they leave, organizations lose institutional knowledge — relationships, system familiarity, and a sense of where their sensitive data really lives. That kind of loss can directly contribute to breaches.”
AI Integration Meets an AI Skills Gap
While nearly every organization surveyed has adopted or plans to adopt AI-powered tools, 48 percent admitted their biggest obstacle is a lack of personnel with AI expertise.
This paradox — using AI to fix a shortage of skilled workers while also lacking the skills to manage AI — is becoming a defining challenge.
Tim Freestone, Chief Strategy Officer at Kiteworks, described it as a “self-limiting cycle.” “Organizations don’t have the personnel to deploy or optimize AI-driven security tools,” he said. “The very solution meant to ease staffing pressures remains underutilized.”
Freestone explained that effective AI implementation requires a blend of competencies: understanding how to operate AI systems, interpreting outputs accurately, and defending against AI-powered attacks. Without those abilities, companies risk introducing new vulnerabilities through poor configuration or overreliance on automation.
Shane Barney, CISO at Keeper Security, agreed. “The skills gap has become a business risk,” he said. “With nearly every company adopting AI to strengthen defenses, the absence of in-house expertise widens the gap between technology and readiness.”
The Evolving Role of AI Skills
The demand for AI expertise isn’t limited to cybersecurity operations. According to Diana Kelley, CISO at Noma Security, AI proficiency now spans multiple domains — from data science to prompt engineering and AI agent development.
“Traditional AI skills such as data science and machine learning engineering continue to be popular,” Kelley said. “But one of the most in-demand GenAI skills is prompt engineering, which is driving value across security, compliance, marketing, and business development.”
She noted that organizations must also secure AI itself. “Every implementation, especially those involving agentic AI, must be governed by the CISO’s organization,” Kelley emphasized. “AI doesn’t just need to be deployed — it needs to be protected.”
Training and Certifications: A Declining Priority
While AI adoption surges, investment in professional development appears to be slowing. The Fortinet survey found that the number of organizations willing to pay for cybersecurity certifications dropped to 73 percent, down from 89 percent the previous year.
That trend worries experts. “If this decline continues, companies may need to rethink their approach as part of their overall risk management strategy,” the report advised.
Lisa Simon, Chief Economist at Revelio Labs, said certifications remain an important way to verify competence, especially in sectors like finance, government, and healthcare. However, she warned against overreliance on credentials alone.
“Only about one in five cybersecurity professionals lists a certification on their profile,” Simon said. “This can slow hiring and inflate costs, while excluding skilled candidates who have hands-on experience but lack formal credentials.”
Simon added that organizations should pair external certifications with internal training and mentorship programs. “In practice, certifications are valuable, but they shouldn’t be the only measure,” she said. “Building diverse talent pipelines and investing in continuous learning will be key to meeting the growing demand for cyber talent.”
The Path Forward: AI and Human Expertise Together
As the lines blur between digital offense and defense, one message is becoming clear: AI is not a replacement for human expertise — it’s an amplifier.
Automation can flag anomalies, predict attacks, and accelerate responses, but without skilled professionals to interpret and act on those insights, its full potential will remain untapped.
The Fortinet report concludes with a reminder that cybersecurity has moved beyond a simple attack-and-defend model. Organizations must now adopt a state of “perpetual vigilance,” combining technology, talent, and training to stay resilient.
In an era where AI both fortifies and threatens the digital frontier, success will depend on how effectively organizations merge innovation with human intelligence — and whether they can close the skills gap before the next wave of attacks arrives.
